shapeup-sdlc 1.6.2

package/hooks/gate-l2.mjs

@@ -0,0 +1,161 @@
+#!/usr/bin/env node
+// GATE L2 — board-green check on the once-per-round EVAL. PreToolUse hook (audit Stage E1).
+//
+// ADVISORY SINCE ADR-0001, and the downgrade was a deliberate product decision rather than a
+// retreat. This hook used to hard-DENY the EVAL delegation (tech-lead → spec-evaluator) while the
+// task board was not green. It now permits the dispatch and says what it found.
+//
+// WHY. The board is LOCAL and per-machine (`.shapeup/<slug>/tasks/`), and the harness runs only on
+// the machine that invoked it — a teammate reads the committed design, they never resume someone
+// else's run. So this gate never protected a team boundary; it protected the operator from their
+// own agent, at the cost of denying a call the operator had asked for. The project chose the
+// signal over the denial.
+//
+// WHAT IS LOST, stated plainly: nothing now mechanically prevents an EVAL on a half-green board.
+// That is a defect this project has measured before (a run reached EVAL with 16/20 task files
+// still `status: ready`). The warning names the offending tasks; it cannot stop the call.
+//
+// WHAT IS RETAINED: the detection is unchanged. Both independent reads still run — per-task
+// frontmatter AND the board table — and the verdict is recorded as `warn`, which is its own row
+// in `decisions.jsonl` precisely so "permitted because green" and "permitted despite not green"
+// never collapse into the same fact (see hooks/lib/decision.mjs).
+//
+// Design (deliberate, conservative):
+//   • Scope — only ever looks at `Skill` → `spec-evaluator` in ROUND mode (`--single-pass`/
+//     `--feature`, no `--task`). A per-task eval (`--task TASK-NNN`) grades one task and is not
+//     in scope: the board-green rule is about the round. Anything else defers instantly.
+//   • Fail-OPEN whenever there is nothing to verify (no --spec, no board file, unparseable input,
+//     zero discoverable tasks) — it only speaks when it can prove the board is partial.
+//
+// Contract: PreToolUse stdin JSON { tool_name, tool_input:{skill_name, skill_args}, cwd, ... }.
+// Advises via { systemMessage } — never { permissionDecision: "deny" }.
+
+//
+// RECEIPTS (v1.5). Every `defer()` below now names WHICH of its fail-open conditions was met, and
+// records it (hooks/lib/decision.mjs). The fail-open direction is unchanged and defended above;
+// what changes is that "read the board and deferred" is no longer byte-identical to "did not run".
+
+import { readFileSync, existsSync, readdirSync } from "node:fs";
+import { resolve, join, basename, dirname } from "node:path";
+import { runHook, readStdin, settle } from "./lib/decision.mjs";
+// Aliased: the body binds a local `tasksDir` to whichever candidate actually holds a board.
+import { tasksDir as localTasksDir } from "../skills/tech-lead/scripts/lib/paths.mjs";
+
+await runHook("gate-l2", async () => {
+/** Allow normal permission flow — with the reason on the record. */
+const defer = (reason, rule) => settle({ verdict: "allow", event: "PreToolUse", tool: p?.tool_name ?? null, reason, rule });
+
+// 1. Read & parse the PreToolUse payload.
+const raw = await readStdin();
+let p;
+try { p = JSON.parse(raw || "{}"); }
+catch (e) { settle({ verdict: "error", event: "PreToolUse", reason: `unparseable payload: ${e.message}` }); }
+
+// 2. Only Skill → spec-evaluator is in scope.
+if (p.tool_name !== "Skill") defer(`not a Skill call (${p.tool_name ?? "no tool_name"}) — out of scope`);
+const skill = p.tool_input?.skill_name || "";
+const args = p.tool_input?.skill_args || "";
+if (skill !== "spec-evaluator") defer(`Skill(${skill || "?"}) is not the judge — out of scope`);
+
+// 3. Round mode only. Two shapes qualify:
+//    (a) legacy flags: --single-pass / --feature, without --task (per-task eval is not gated);
+//    (b) pure-skill envelope (v1.0): --order <WorkOrder> whose operation is "evaluate" — the
+//        round dispatch tech-lead compiles. Slug/spec come from the order itself.
+let orderSlug = null, orderSpec = null;
+const om = args.match(/--order(?:\s+|=)(?:"([^"]+)"|'([^']+)'|(\S+))/);
+if (om) {
+  try {
+    const order = JSON.parse(readFileSync(resolve(p.cwd || process.cwd(), om[1] || om[2] || om[3]), "utf8"));
+    if (order.worker === "spec-evaluator" && (order.operation || "evaluate") === "evaluate") {
+      orderSlug = String(order.order_id || "").split("/")[0] || order.payload?.feature || null;
+      orderSpec = order.payload?.spec_folder || null;
+    } else defer("order is for another job — not the round EVAL", "--order"); // not the round EVAL
+  } catch (e) {
+    if (e?.name === "HookDecision") throw e;
+    /* unreadable order → validate-envelope denies it; nothing to gate here */
+    defer(`order unreadable (${e.message}) — validate-envelope owns that denial`, "--order");
+  }
+}
+const hasTask = /--task(?:\s|=)/.test(args);
+const roundMode = orderSlug !== null || (!hasTask && (/--single-pass\b/.test(args) || /--feature(?:\s|=)/.test(args)));
+if (!roundMode) defer(hasTask ? "per-task eval — the board-green rule is about the round" : "not a round dispatch", "round-mode");
+
+// 4. Locate the board. Since v0.4.0 (Local Tasks Architecture) it lives under the LOCAL
+//    gitignored root `.shapeup/<slug>/tasks/`, NOT the committed spec dir — resolving only
+//    `<spec>/tasks/` made this hook silently fail-open on every v0.4.0+ run (the island-escape
+//    hole: EVAL proceeded with 16/20 task files still `status: ready`).
+//    <slug> comes from --feature (the round invocation always carries it: tech-lead's eval plan
+//    is `--spec <path> --feature <slug> --single-pass`), falling back to the spec-path
+//    convention shapeup/<slug>/spec → parent dir name. `<spec>/tasks/` is kept as the
+//    legacy fallback so pre-v0.4.0 boards stay gated. A missing board on every candidate is a
+//    legitimate state — spec-evaluator v0.9 grades from the committed spec on machines that
+//    never generated a local board — so it stays fail-open.
+const m = args.match(/--spec(?:\s+|=)(?:"([^"]+)"|'([^']+)'|(\S+))/);
+const specPath = orderSpec || (m ? (m[1] || m[2] || m[3]) : null);
+if (!specPath && !orderSlug) defer("no --spec and no order slug — nothing to locate a board from", "no-spec");
+const cwd = p.cwd || process.cwd();
+const specDir = specPath ? resolve(cwd, specPath) : null;
+const fm = args.match(/--feature(?:\s+|=)(?:"([^"]+)"|'([^']+)'|(\S+))/);
+const slug = orderSlug || (fm && (fm[1] || fm[2] || fm[3])) ||
+  (basename(specDir) === "spec" ? basename(dirname(specDir)) : basename(specDir));
+const tasksDir = [localTasksDir(cwd, slug), ...(specDir ? [join(specDir, "tasks")] : [])]
+  .find((d) => existsSync(join(d, "_index.md")));
+// no board on this machine → nothing to verify, don't break the run
+if (!tasksDir) defer(`no board for "${slug}" on this machine — nothing to verify`, "no-board");
+const board = join(tasksDir, "_index.md");
+
+// 5. Assert the board is green, from two independent reads; fail-closed if EITHER shows unfinished
+//    work. (a) per-task frontmatter `status:` (the authoritative field); (b) the board table's
+//    status cell (what GATE L2 literally reads). Done = `status: done` / a ✅ in the row.
+const DONE_FRONTMATTER = /^status:\s*done\s*$/im;
+const NOT_DONE_MARK = /⬜|🔄|🚫|\b(ready|in-progress|blocked)\b/i;
+const unfinished = new Set();
+
+// (a) task files
+let sawTaskFile = false;
+try {
+  for (const f of readdirSync(tasksDir)) {
+    if (!/^TASK-[\w.-]+\.md$/i.test(f)) continue; // skip _index.md and non-task files
+    sawTaskFile = true;
+    const body = readFileSync(join(tasksDir, f), "utf8");
+    const fm = body.match(/^---\r?\n([\s\S]*?)\r?\n---/);
+    const id = (body.match(/^id:\s*(TASK-[\w.-]+)/im) || [])[1] || f.replace(/\.md$/, "");
+    if (!fm || !DONE_FRONTMATTER.test(fm[1])) unfinished.add(id);
+  }
+} catch { /* unreadable tasks dir → fall back to board table below */ }
+
+// (b) board table rows — any row naming a task whose status cell is not ✅/done.
+let sawBoardRow = false;
+for (const line of readFileSync(board, "utf8").split(/\r?\n/)) {
+  const idm = line.match(/\bTASK-[\w.-]+/);
+  if (!idm || !line.includes("|")) continue;
+  sawBoardRow = true;
+  const done = line.includes("✅") || /\bdone\b/i.test(line);
+  if (!done || NOT_DONE_MARK.test(line)) unfinished.add(idm[0]);
+}
+
+// 6. If neither source yielded a single task, there's nothing to assert → defer.
+if (!sawTaskFile && !sawBoardRow) defer("board directory holds zero tasks — nothing to assert", "empty-board");
+
+// 7. Verdict.
+// Board fully green → allow the EVAL. THIS is the row that used to be indistinguishable from the
+// gate never having run: same exit code, same empty stdout, opposite meaning.
+if (unfinished.size === 0) defer(`board green — ${sawTaskFile ? "task files" : "board rows"} all done, EVAL permitted`, "board-green");
+
+// Board is partial. Advise, and record it as its own verdict — a `warn` row is what keeps
+// "evaluated a non-green board" countable after the denial was removed (ADR-0001).
+const list = [...unfinished].sort().join(", ");
+return {
+  verdict: "warn", event: "PreToolUse", tool: "Skill", subject: slug, rule: "board-not-green",
+  reason: `${unfinished.size} unfinished task(s): ${list}`,
+  payload: {
+    systemMessage:
+      `⚠ GATE L2 — the board is NOT green and the EVAL is proceeding anyway.\n` +
+      `Unfinished (${unfinished.size}): ${list}\n` +
+      `EVAL is designed to run once per round, after every task is done. A verdict taken now grades ` +
+      `a partial board, so a PASS does not mean the feature is complete — it means the finished part ` +
+      `passed. Route back to BUILD (task-executor) to close these, or use --task for a deliberate ` +
+      `single-task check.`,
+  },
+};
+});

package/hooks/gate-zerowork.mjs

@@ -0,0 +1,264 @@
+#!/usr/bin/env node
+// GATE Z — ZERO-WORK. Blocking Stop hook. The detector for "the harness described itself".
+//
+// WHY THIS EXISTS (measured, not theorized).
+//
+// SDD harness benchmark, F2, Haiku 4.5, n=5, zero variance. The orchestrator was dispatched
+// with a valid spec and returned this, in full:
+//
+//     TOOL   Skill(tech-lead, "--unattended --rounds 3\n\n# F2 — category budgets…")
+//     TEXT   "The tech-lead skill is orchestrating the full Shape Up harness. It will: 1. …"
+//     FINAL  (same text — session ends)
+//
+// No code. No board. No gate artifacts. Prose that reads exactly like a successful run.
+// That is the "agent claims done" pathology this project exists to prevent, reproduced by the
+// project, at its own front door.
+//
+// THE TWO STRUCTURAL MISSES IT EXPOSED. `anti-rationalization.mjs` is the guard for exactly
+// this class of failure, and it could not see this one for two independent reasons:
+//
+//   1. SCOPE. It defers unless a run is active (`activeSlug()` → `.shapeup/<slug>/`).
+//      A run that never started produces none of the files it reads. It catches "claimed done
+//      on a half-green board" and misses "claimed done with no board at all". The emptier the
+//      failure, the less of it there is to detect.
+//   2. CLAIM SHAPE. Its detector matches PAST-tense completion — done, finished, shipped, all
+//      tests pass. Narration is FUTURE-tense: "it will". Fix the scope and this transcript
+//      still slips through, because narration never claims completion. It promises it.
+//
+// So this hook does not look at what the message says. It looks at whether anything happened.
+// The predicate is mechanical and model-independent:
+//
+//     the session dispatched the orchestrator   AND   the run left no receipt
+//
+// `init-run.mjs` writes that receipt as the orchestrator's first tool call. Its absence is the
+// fact. Nothing here parses intent, so nothing here can be talked past.
+//
+// WHY THIS ONE BLOCKS, WHEN anti-rationalization DOES NOT. The invariant is "QA is a level-up,
+// not a gate" — no second judge behind `spec-evaluator`. That governs quality JUDGMENTS. This
+// hook makes no judgment: it reports that no work exists to judge. Blocking is also uniquely
+// safe here, because a session with no artifacts has nothing to lose by continuing, and a
+// blocking Stop is the only mechanism that turns narration back into execution — an advisory
+// note at the end of a narrated run just gets narrated too.
+//
+// Loop safety: `stop_hook_active` defers unconditionally, so this fires at most once per stop
+// chain. Everything ambiguous fails open — a hook that blocks legitimate sessions gets disabled,
+// and a disabled hook enforces nothing.
+//
+// Contract: Stop stdin JSON { cwd, stop_hook_active, last_assistant_message, transcript_path }.
+// Blocks via { decision: "block", reason }. Always exits 0.
+
+// SECOND CONDITION (v1.5). Since `hooks/lib/decision.mjs` gives every hook a receipt, this gate
+// gains a second, independent fact it can assert at `Stop`: the orchestrator was dispatched, and
+// `decisions.jsonl` holds ZERO rows for this pid — meaning the enforcement layer itself never ran.
+// That is F-16's class, not its instance: under a symlinked install every gate was inert while
+// every gate reported success. The detector for "the gates didn't run" now stops depending on the
+// gates running.
+
+import { readFileSync, readdirSync, existsSync, statSync } from "node:fs";
+import { join } from "node:path";
+import { isMain } from "../skills/tech-lead/scripts/lib/is-main.mjs";
+import { localDir, globLocal } from "../skills/tech-lead/scripts/lib/paths.mjs";
+import { runHook, readStdin, settle, decisionsPath } from "./lib/decision.mjs";
+
+const MAX_TRANSCRIPT_BYTES = 20 * 1024 * 1024;
+
+/** Tool names that constitute doing something to the project, as opposed to looking at it. */
+const WORK_TOOLS = new Set(["Write", "Edit", "MultiEdit", "NotebookEdit", "Bash", "Task", "Agent"]);
+
+/** Did this session dispatch the orchestrator? Skill(tech-lead) in any of its surface spellings. */
+export function dispatchedOrchestrator(events) {
+  for (const ev of events) {
+    for (const block of toolUses(ev)) {
+      if (block.name !== "Skill") continue;
+      const skill = String(block.input?.skill ?? block.input?.skill_name ?? "");
+      if (skill.split(":").pop() === "tech-lead") return true;
+    }
+    // The slash command is the other front door: `/shapeup-sdlc-plugin:ship …` arrives as user
+    // text, and reaches tech-lead through commands/ship.md.
+    //
+    // ANCHORED TO THE START OF THE MESSAGE, deliberately. A slash command IS the message — the CLI
+    // only dispatches one when it leads. Matching `/ship` anywhere in the text meant "how does
+    // /ship decide the lane?" counted as a dispatch, and in a repo with no run that answer is a
+    // Stop block: the session refuses to end and the model is told to bootstrap a feature nobody
+    // asked for. A gate that fires on a session merely TALKING about the harness is a gate users
+    // turn off, and it takes the real zero-work block down with it.
+    if (ev?.type === "user") {
+      const c = ev?.message?.content ?? ev?.content;
+      const text = typeof c === "string" ? c : Array.isArray(c) ? c.map((b) => b?.text || "").join("\n") : "";
+      if (/^\s*\/(?:[\w-]+:)?ship\b/.test(text)) return true;
+    }
+  }
+  return false;
+}
+
+function toolUses(ev) {
+  const c = ev?.message?.content ?? ev?.content;
+  return Array.isArray(c) ? c.filter((b) => b?.type === "tool_use") : [];
+}
+
+/** How much actual work the session did, by tool class. */
+export function workCensus(events) {
+  const census = { tool_calls: 0, work_calls: 0, writes: 0, by_tool: {} };
+  for (const ev of events) {
+    for (const block of toolUses(ev)) {
+      census.tool_calls++;
+      census.by_tool[block.name] = (census.by_tool[block.name] || 0) + 1;
+      if (WORK_TOOLS.has(block.name)) census.work_calls++;
+      if (block.name === "Write" || block.name === "Edit" || block.name === "MultiEdit") census.writes++;
+    }
+  }
+  return census;
+}
+
+/** Any run receipt on disk, from any run. Written by init-run.mjs as the run's first act. */
+export function findReceipts(cwd) {
+  const root = localDir(cwd);
+  if (!existsSync(root)) return [];
+  const out = [];
+  let entries;
+  try { entries = readdirSync(root); } catch { return []; }
+  for (const entry of entries) {
+    const p = join(root, entry, "receipt.json");
+    if (!existsSync(p)) continue;
+    try {
+      const r = JSON.parse(readFileSync(p, "utf8"));
+      if (r?.started) out.push({ slug: entry, receipt: r, mtime: statSync(p).mtimeMs });
+    } catch { /* unreadable receipt is not a receipt */ }
+  }
+  return out;
+}
+
+/**
+ * Future-tense narration: the signature of describing a pipeline instead of running it.
+ * Advisory only — it sharpens the message, it never decides the block. The block is decided
+ * by the absence of a receipt, which no phrasing can change.
+ */
+export function detectNarration(text) {
+  if (!text || typeof text !== "string") return null;
+  const m = /\b(will (?:now )?(?:run|orchestrate|execute|proceed|begin|start)|is orchestrating|I'?ll (?:now )?(?:run|start|begin|orchestrate)|going to (?:run|orchestrate|execute)|here'?s (?:what|how) (?:it|the harness) will)\b/i.exec(text);
+  return m ? m[0] : null;
+}
+
+function readEvents(transcriptPath) {
+  try {
+    if (!transcriptPath || !existsSync(transcriptPath)) return null;
+    if (statSync(transcriptPath).size > MAX_TRANSCRIPT_BYTES) return null;
+    return readFileSync(transcriptPath, "utf8")
+      .split("\n")
+      .filter(Boolean)
+      .map((l) => { try { return JSON.parse(l); } catch { return null; } })
+      .filter(Boolean);
+  } catch { return null; }
+}
+
+/**
+ * Did the enforcement layer leave any evidence of itself in this checkout?
+ *
+ * A hook that never runs and a hook that inspected-and-permitted used to produce identical
+ * evidence (exit 0, empty stdout). With `hooks/lib/decision.mjs` every evaluation appends a row,
+ * so ZERO rows across the whole file is now a positive fact about the layer rather than an absence
+ * of information about it.
+ *
+ * @param {string} cwd - Project root.
+ * @returns {{rows:number, readable:boolean}} How many decision rows exist and whether the ledger
+ *   could be read at all (an unreadable ledger proves nothing and must not sharpen the message).
+ */
+export function enforcementCensus(cwd) {
+  const p = decisionsPath(cwd);
+  if (!existsSync(p)) return { rows: 0, readable: false };
+  try {
+    return { rows: readFileSync(p, "utf8").split("\n").filter((l) => l.trim()).length, readable: true };
+  } catch { return { rows: 0, readable: false }; }
+}
+
+export function buildReason({ narration, census, enforcement }) {
+  return [
+    "✋ GATE Z — ZERO WORK. This session dispatched the tech-lead orchestrator and produced no run receipt.",
+    "",
+    `Mechanical facts: ${census.tool_calls} tool call(s), ${census.work_calls} of them work calls, ` +
+    `${census.writes} file write(s), and no \`${globLocal("<slug>", "receipt.json")}\`.`,
+    narration ? `The final message reads as a plan, not a result (matched: "${narration}").` : null,
+    enforcement && enforcement.readable && enforcement.rows === 0
+      ? "AND the enforcement layer left zero decision rows — the gates did not merely permit this run, they never ran. " +
+        "Check the plugin install (a symlinked or spaced path was the measured cause; see lib/is-main.mjs)."
+      : null,
+    "",
+    "A run that describes its own pipeline and stops is the exact failure this harness exists to",
+    "prevent — measured at 29% acceptance with 10 escaped defects while looking like a clean run.",
+    "Loading the instructions is not running them.",
+    "",
+    "Do the work now, starting with the first step of the runbook:",
+    "",
+    "  # write the requirement to a file first — inlining multi-line text into a shell",
+    "  # argument is where this step goes wrong",
+    "  node \"${CLAUDE_PLUGIN_ROOT}/skills/tech-lead/scripts/init-run.mjs\" \\",
+    "       --slug <slug> --intake-file <path/to/requirement.md> \\",
+    "       --auto-level <interactive|auto|unattended> [--gate-answers <preset|path>]",
+    "",
+    "Then proceed through the gates, resolving each one with:",
+    "",
+    "  node \"${CLAUDE_PLUGIN_ROOT}/skills/tech-lead/scripts/gate-answers.mjs\" --resolve <gate-id> …",
+    "",
+    "If the command comes back \"requires approval\", say so and stop — the harness's scripts ship with",
+    "the plugin and need a one-time permission grant (`npx shapeup-sdlc init` writes it). Do NOT route",
+    "around it with wrapper scripts, and do NOT hand-build the feature instead: a feature built outside",
+    "the harness has no board, no T0 and no verdict, which is the un-evidenced \"done\" this exists to stop.",
+    "",
+    "If the requirement genuinely cannot be built, say why in one sentence — an explicit refusal is",
+    "a real answer. A future-tense summary of what the harness would have done is not.",
+  ].filter((l) => l !== null).join("\n");
+}
+
+async function main() {
+  await runHook("gate-zerowork", async () => {
+  const raw = await readStdin();
+
+  let p;
+  /** Fail-open, with the reason on the record (hooks/lib/decision.mjs). */
+  const defer = (reason, rule) => settle({ verdict: "allow", event: "Stop", cwd: p?.cwd, reason, rule });
+  try { p = JSON.parse(raw || "{}"); }
+  catch (e) { settle({ verdict: "error", event: "Stop", reason: `unparseable payload: ${e.message}` }); }
+
+  // At most one block per stop chain. Without this a session that cannot run the script at all
+  // (read-only cwd, missing node) would be held open forever.
+  if (p.stop_hook_active) defer("stop_hook_active — at most one block per stop chain", "loop-guard");
+
+  const cwd = p.cwd || process.cwd();
+  const events = readEvents(p.transcript_path);
+  // no transcript → no facts → fail open
+  if (!events || events.length === 0) defer("no readable transcript — no facts to assert", "no-transcript");
+
+  // not a harness session → not our business
+  if (!dispatchedOrchestrator(events)) defer("session never dispatched the orchestrator — not a harness run", "no-dispatch");
+
+  // A receipt means the run started. What happens after that is anti-rationalization's job and
+  // the evaluator's; this hook only asks whether anything started at all.
+  const receipts = findReceipts(cwd);
+  if (receipts.length > 0) defer(`${receipts.length} run receipt(s) on disk — the run started`, "receipt-present");
+
+  const census = workCensus(events);
+
+  // Fail open when the session clearly did work by other means. A user may have run the harness
+  // steps by hand, or be on a pre-receipt version of the plugin. Real narration has ~zero work
+  // calls; this threshold keeps the hook off everything else.
+  if (census.work_calls > 2) defer(`${census.work_calls} work calls — the session did work by other means`, "work-done");
+
+  const message = typeof p.last_assistant_message === "string" ? p.last_assistant_message : "";
+  const narration = detectNarration(message);
+  const enforcement = enforcementCensus(cwd);
+
+  return {
+    verdict: "block", event: "Stop", cwd, rule: "no-receipt",
+    reason: `orchestrator dispatched, ${census.work_calls} work call(s), no run receipt` +
+      (enforcement.readable && enforcement.rows === 0 ? "; enforcement layer left zero decision rows" : ""),
+    payload: {
+      decision: "block",
+      reason: buildReason({ narration, census, enforcement }),
+    },
+  };
+  });
+}
+
+if (isMain(import.meta.url)) {
+  main();
+}

package/hooks/hooks.json

@@ -0,0 +1,118 @@
+{
+  "hooks": {
+    "SessionStart": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "echo \"shapeup-sdlc-plugin loaded from ${CLAUDE_PLUGIN_ROOT}\""
+          }
+        ]
+      },
+      {
+        "matcher": "startup|compact|resume|clear",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/session-rehydrate.mjs\"",
+            "timeout": 10
+          }
+        ]
+      }
+    ],
+    "PreCompact": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/compact-snapshot.mjs\"",
+            "timeout": 10
+          }
+        ]
+      }
+    ],
+    "PreToolUse": [
+      {
+        "matcher": "Bash|Read|Write|Edit|MultiEdit",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/safety-spine.mjs\"",
+            "timeout": 10
+          }
+        ]
+      },
+      {
+        "matcher": "Skill",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/gate-l2.mjs\"",
+            "timeout": 10
+          }
+        ]
+      },
+      {
+        "matcher": "Skill",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/gate-intake.mjs\"",
+            "timeout": 10
+          }
+        ]
+      },
+      {
+        "matcher": "Skill",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/gate-deadline.mjs\"",
+            "timeout": 10
+          }
+        ]
+      },
+      {
+        "matcher": "Skill|Agent",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/skills/tech-lead/scripts/validate-envelope.mjs\"",
+            "timeout": 10
+          }
+        ]
+      },
+      {
+        "matcher": "Edit|Write|MultiEdit",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/sandbox-guard.mjs\"",
+            "timeout": 10
+          }
+        ]
+      }
+    ],
+    "Stop": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/gate-zerowork.mjs\"",
+            "timeout": 10
+          },
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/anti-rationalization.mjs\"",
+            "timeout": 10
+          },
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/slop-cleaner.mjs\"",
+            "timeout": 15
+          }
+        ]
+      }
+    ]
+  }
+}