shapeup-sdlc 3.18.2 → 4.0.0

package/hooks/gate-zerowork.mjs

@@ -1,349 +0,0 @@
-#!/usr/bin/env node
-// GATE Z — ZERO-WORK. Blocking Stop hook. The detector for "the harness described itself".
-//
-// WHY THIS EXISTS (reproduced, not theorized).
-//
-// Dispatched with a valid spec, the orchestrator returned this, in full:
-//
-//     TOOL   Skill(tech-lead, "--unattended --rounds 3\n\n# F2 — category budgets…")
-//     TEXT   "The tech-lead skill is orchestrating the full Shape Up harness. It will: 1. …"
-//     FINAL  (same text — session ends)
-//
-// No code. No board. No gate artifacts. Prose that reads exactly like a successful run.
-// That is the "agent claims done" pathology this project exists to prevent, reproduced by the
-// project, at its own front door.
-//
-// THE TWO STRUCTURAL MISSES IT EXPOSED. the ship report's census is the guard for exactly
-// this class of failure, and it could not see this one for two independent reasons:
-//
-//   1. SCOPE. It defers unless a run is active (`activeSlug()` → `.shapeup/<slug>/`).
-//      A run that never started produces none of the files it reads. It catches "claimed done
-//      on a half-green board" and misses "claimed done with no board at all". The emptier the
-//      failure, the less of it there is to detect.
-//   2. CLAIM SHAPE. Its detector matches PAST-tense completion — done, finished, shipped, all
-//      tests pass. Narration is FUTURE-tense: "it will". Fix the scope and this transcript
-//      still slips through, because narration never claims completion. It promises it.
-//
-// So this hook does not look at what the message says. It looks at whether anything happened.
-// The predicate is mechanical and model-independent:
-//
-//     the session dispatched the orchestrator   AND   the run left no receipt
-//
-// ``harness init run`` writes that receipt as the orchestrator's first tool call. Its absence is the
-// fact. Nothing here parses intent, so nothing here can be talked past.
-//
-// WHY THIS ONE BLOCKS, WHEN the ship report's census DOES NOT. The invariant is "QA is a level-up,
-// not a gate" — no second judge behind `spec-evaluator`. That governs quality JUDGMENTS. This
-// hook makes no judgment: it reports that no work exists to judge. Blocking is also uniquely
-// safe here, because a session with no artifacts has nothing to lose by continuing, and a
-// blocking Stop is the only mechanism that turns narration back into execution — an advisory
-// note at the end of a narrated run just gets narrated too.
-//
-// Loop safety: `stop_hook_active` defers unconditionally, so this fires at most once per stop
-// chain. Everything ambiguous fails open — a hook that blocks legitimate sessions gets disabled,
-// and a disabled hook enforces nothing.
-//
-// Contract: Stop stdin JSON { cwd, stop_hook_active, last_assistant_message, transcript_path }.
-// Blocks via { decision: "block", reason }. Always exits 0.
-
-// SECOND CONDITION (v1.5). Since `hooks/lib/decision.mjs` gives every hook a receipt, this gate
-// gains a second, independent fact it can assert at `Stop`: the orchestrator was dispatched, and
-// `decisions.jsonl` holds ZERO rows for this pid — meaning the enforcement layer itself never ran.
-// That is a whole CLASS of failure, not one instance: under a symlinked install every gate can be
-// inert while every gate reports success. The detector for "the gates didn't run" therefore stops
-// depending on the gates running.
-
-import { readFileSync, readdirSync, existsSync, statSync } from "node:fs";
-import { join } from "node:path";
-import { isMain } from "../kernel/lib/argv.mjs";
-import { localDir, globLocal, globWorkflowsStage } from "../kernel/lib/paths.mjs";
-import { runHook, readStdin, settle, decisionsPath, projectRoot } from "./lib/decision.mjs";
-
-const MAX_TRANSCRIPT_BYTES = 20 * 1024 * 1024;
-
-/**
- * Tool names that constitute doing something to the project, as opposed to looking at it.
- *
- * The census these produce is now DESCRIPTIVE ONLY — it sharpens the block message and nothing
- * decides on it. Until v1.7.1 a count above two was a fail-open ("the session did work by other
- * means"), and it was retired for the reason spelled out at the `work-done` note below. `Workflow` stays absent because a launch is not work — it is the work this hook is
- * asking about — and it is a DISPATCH signal instead (`dispatchedOrchestrator`).
- */
-const WORK_TOOLS = new Set(["Write", "Edit", "MultiEdit", "NotebookEdit", "Bash", "Task", "Agent"]);
-
-/**
- * Is this block a launch of the orchestrator's own workflow script, by either surface?
- *
- * The shipped front door is `Workflow({scriptPath})`; `npx shapeup-sdlc init` writes the grant it
- * needs. The Bash arm below is kept because a project that declined that grant, or one still on a
- * v1 install, launches the same script through a Bash runtime — a gate that knew only one surface
- * would go blind on the lane those users actually run, which is the same "the emptier the failure,
- * the less of it there is to detect" hole the banner above describes.
- *
- * Matched on the BASENAME, anchored. `CLAUDE_PLUGIN_ROOT` itself ends in `shapeup-sdlc-plugin/` on
- * a normal install — so a substring match on the whole path would count EVERY workflow script that
- * happens to live under the plugin root, including one a user wrote for something else. The
- * basename is the part the skill controls and the part `SKILL.md` names.
- *
- * @param {object} block - A `tool_use` content block.
- * @returns {boolean} True when the block launches a `shapeup-*` workflow.
- */
-function launchedShapeupWorkflow(block) {
-  if (block.name === "Bash") {
-    const cmd = String(block.input?.command ?? "");
-    // Both halves required: a node launcher AND an orchestrator script. A launcher carrying
-    // somebody else's workflow is not a harness dispatch, and neither is a bare mention of the
-    // script in an unrelated command (`ls`, `cat`).
-    return /\bnode\b/.test(cmd) && /[\\/]shapeup-[\w.-]*\.[cm]?js\b/.test(cmd);
-  }
-  if (block.name !== "Workflow") return false;
-  const scriptPath = String(block.input?.scriptPath ?? "");
-  const base = scriptPath.split(/[\\/]/).pop().replace(/\.[cm]?js$/, "");
-  const named = String(block.input?.name ?? "");
-  return /^shapeup-/.test(base) || /^shapeup-/.test(named);
-}
-
-/**
- * Did this session dispatch the orchestrator? Three surface spellings, all equivalent:
- * `Skill(tech-lead)`, a leading `/ship` slash command, and — since the workflow cutover (v1.7) —
- * a `Workflow` tool_use launching one of the orchestrator's own `shapeup-*` scripts.
- *
- * The third arm is a correctness repair, not a new detector. `SKILL.md`'s Step 2 makes the
- * Workflow launch the scoped lane's front door, so a session can now reach the orchestrator
- * without ever emitting `Skill(tech-lead)` — and before this arm existed such a session was
- * invisible to the gate, exactly the "the emptier the failure, the less of it there is to detect"
- * hole the banner above describes. It is a TRIGGER, never an escape: a launch that left no
- * receipt is still a blocked stop, because a `Workflow` call that returned without starting a run
- * is precisely the narration case wearing a tool call.
- */
-export function dispatchedOrchestrator(events) {
-  for (const ev of events) {
-    for (const block of toolUses(ev)) {
-      if (launchedShapeupWorkflow(block)) return true;
-      if (block.name !== "Skill") continue;
-      const skill = String(block.input?.skill ?? block.input?.skill_name ?? "");
-      if (skill.split(":").pop() === "tech-lead") return true;
-    }
-    // The slash command is the other front door: `/shapeup-sdlc-plugin:ship …` arrives as user
-    // text, and reaches tech-lead through commands/ship.md.
-    //
-    // ANCHORED TO THE START OF THE MESSAGE, deliberately. A slash command IS the message — the CLI
-    // only dispatches one when it leads. Matching `/ship` anywhere in the text meant "how does
-    // /ship decide the lane?" counted as a dispatch, and in a repo with no run that answer is a
-    // Stop block: the session refuses to end and the model is told to bootstrap a feature nobody
-    // asked for. A gate that fires on a session merely TALKING about the harness is a gate users
-    // turn off, and it takes the real zero-work block down with it.
-    if (ev?.type === "user") {
-      const c = ev?.message?.content ?? ev?.content;
-      const text = typeof c === "string" ? c : Array.isArray(c) ? c.map((b) => b?.text || "").join("\n") : "";
-      if (/^\s*\/(?:[\w-]+:)?ship\b/.test(text)) return true;
-    }
-  }
-  return false;
-}
-
-function toolUses(ev) {
-  const c = ev?.message?.content ?? ev?.content;
-  return Array.isArray(c) ? c.filter((b) => b?.type === "tool_use") : [];
-}
-
-/** How much actual work the session did, by tool class. */
-export function workCensus(events) {
-  const census = { tool_calls: 0, work_calls: 0, writes: 0, by_tool: {} };
-  for (const ev of events) {
-    for (const block of toolUses(ev)) {
-      census.tool_calls++;
-      census.by_tool[block.name] = (census.by_tool[block.name] || 0) + 1;
-      if (WORK_TOOLS.has(block.name)) census.work_calls++;
-      if (block.name === "Write" || block.name === "Edit" || block.name === "MultiEdit") census.writes++;
-    }
-  }
-  return census;
-}
-
-/** Any run receipt on disk, from any run. Written by `harness init run` as the run's first act. */
-export function findReceipts(cwd) {
-  const root = localDir(cwd);
-  if (!existsSync(root)) return [];
-  const out = [];
-  let entries;
-  try { entries = readdirSync(root); } catch { return []; }
-  for (const entry of entries) {
-    const p = join(root, entry, "receipt.json");
-    if (!existsSync(p)) continue;
-    try {
-      const r = JSON.parse(readFileSync(p, "utf8"));
-      if (r?.started) out.push({ slug: entry, receipt: r, mtime: statSync(p).mtimeMs });
-    } catch { /* unreadable receipt is not a receipt */ }
-  }
-  return out;
-}
-
-/**
- * Future-tense narration: the signature of describing a pipeline instead of running it.
- * Advisory only — it sharpens the message, it never decides the block. The block is decided
- * by the absence of a receipt, which no phrasing can change.
- */
-export function detectNarration(text) {
-  if (!text || typeof text !== "string") return null;
-  const m = /\b(will (?:now )?(?:run|orchestrate|execute|proceed|begin|start)|is orchestrating|I'?ll (?:now )?(?:run|start|begin|orchestrate)|going to (?:run|orchestrate|execute)|here'?s (?:what|how) (?:it|the harness) will)\b/i.exec(text);
-  return m ? m[0] : null;
-}
-
-function readEvents(transcriptPath) {
-  try {
-    if (!transcriptPath || !existsSync(transcriptPath)) return null;
-    if (statSync(transcriptPath).size > MAX_TRANSCRIPT_BYTES) return null;
-    return readFileSync(transcriptPath, "utf8")
-      .split("\n")
-      .filter(Boolean)
-      .map((l) => { try { return JSON.parse(l); } catch { return null; } })
-      .filter(Boolean);
-  } catch { return null; }
-}
-
-/**
- * Did the enforcement layer leave any evidence of itself in this checkout?
- *
- * A hook that never runs and a hook that inspected-and-permitted used to produce identical
- * evidence (exit 0, empty stdout). With `hooks/lib/decision.mjs` every evaluation appends a row,
- * so ZERO rows across the whole file is now a positive fact about the layer rather than an absence
- * of information about it.
- *
- * @param {string} cwd - Project root.
- * @returns {{rows:number, readable:boolean}} How many decision rows exist and whether the ledger
- *   could be read at all (an unreadable ledger proves nothing and must not sharpen the message).
- */
-export function enforcementCensus(cwd) {
-  const p = decisionsPath(cwd);
-  if (!existsSync(p)) return { rows: 0, readable: false };
-  try {
-    return { rows: readFileSync(p, "utf8").split("\n").filter((l) => l.trim()).length, readable: true };
-  } catch { return { rows: 0, readable: false }; }
-}
-
-export function buildReason({ narration, census, enforcement }) {
-  return [
-    "✋ GATE Z — ZERO WORK. This session dispatched the tech-lead orchestrator and produced no run receipt.",
-    "",
-    `Mechanical facts: ${census.tool_calls} tool call(s), ${census.work_calls} of them work calls, ` +
-    `${census.writes} file write(s), and no \`${globLocal("<slug>", "receipt.json")}\`.`,
-    narration ? `The final message reads as a plan, not a result (matched: "${narration}").` : null,
-    census.work_calls > 2
-      ? `Those ${census.work_calls} work calls are why this block exists, not a reason to waive it: a busy ` +
-        "session used to switch this gate off. Work done AROUND the harness has no board, no T0 verdict and " +
-        "no receipt — a hand-built feature can pass its own oracle while the pipeline never ran."
-      : null,
-    enforcement && enforcement.readable && enforcement.rows === 0
-      ? "AND the enforcement layer left zero decision rows — the gates did not merely permit this run, they never ran. " +
-        "Check the plugin install — a symlinked path or a path with a space is the usual cause."
-      : null,
-    "",
-    "A run that describes its own pipeline and stops is the exact failure this harness exists to",
-    "prevent: it reads like a clean run and leaves escaped defects behind it.",
-    "Loading the instructions is not running them.",
-    "",
-    "Do the work now, starting with the first step of the runbook:",
-    "",
-    "  # write the requirement to a file first — inlining multi-line text into a shell",
-    "  # argument is where this step goes wrong",
-    "  node \"${CLAUDE_PLUGIN_ROOT}/kernel/harness.mjs\" init run \\",
-    "       --slug <slug> --intake-file <path/to/requirement.md> \\",
-    "       --auto-level <interactive|auto|unattended> [--gate-answers <preset|path>]",
-    "",
-    "Then launch the lane itself with the Workflow tool (`npx shapeup-sdlc init` writes the grant",
-    "it needs, unless --no-native-workflow was given, in which case approve the launch once):",
-    "",
-    "  Workflow({",
-    `    scriptPath: "${globWorkflowsStage("shapeup-run.js")}",  // staged by \`init run\`, above`,
-    "    args: <the RunArgs object>",
-    "  })",
-    "",
-    "Resolve each gate the run pauses at with:",
-    "",
-    "  node \"${CLAUDE_PLUGIN_ROOT}/kernel/harness.mjs\" gate --resolve <gate-id> …",
-    "",
-    "If the command comes back \"requires approval\", say so and stop — the harness's scripts ship with",
-    "the plugin and need a one-time permission grant (`npx shapeup-sdlc init` writes it). Do NOT route",
-    "around it with wrapper scripts, and do NOT hand-build the feature instead: a feature built outside",
-    "the harness has no board, no T0 and no verdict, which is the un-evidenced \"done\" this exists to stop.",
-    "",
-    "If the requirement genuinely cannot be built, say why in one sentence — an explicit refusal is",
-    "a real answer. A future-tense summary of what the harness would have done is not.",
-  ].filter((l) => l !== null).join("\n");
-}
-
-async function main() {
-  await runHook("gate-zerowork", async () => {
-  const raw = await readStdin();
-
-  let p;
-  /** Fail-open, with the reason on the record (hooks/lib/decision.mjs). */
-  const defer = (reason, rule) => settle({ verdict: "allow", event: "Stop", cwd: p?.cwd, reason, rule });
-  try { p = JSON.parse(raw || "{}"); }
-  catch (e) { settle({ verdict: "error", event: "Stop", reason: `unparseable payload: ${e.message}` }); }
-
-  // At most one block per stop chain. Without this a session that cannot run the script at all
-  // (read-only cwd, missing node) would be held open forever.
-  if (p.stop_hook_active) defer("stop_hook_active — at most one block per stop chain", "loop-guard");
-
-  // Receipts and the decision ledger sit at the project root, wherever the session's shell ended
-  // up (see `projectRoot`); a run started from the top must not read as "never started" because
-  // the last command `cd`ed somewhere.
-  const cwd = projectRoot(p.cwd || process.cwd());
-  const events = readEvents(p.transcript_path);
-  // no transcript → no facts → fail open
-  if (!events || events.length === 0) defer("no readable transcript — no facts to assert", "no-transcript");
-
-  // not a harness session → not our business
-  if (!dispatchedOrchestrator(events)) defer("session never dispatched the orchestrator — not a harness run", "no-dispatch");
-
-  // A receipt means the run started. What happens after that is the ship report's census's job and
-  // the evaluator's; this hook only asks whether anything started at all.
-  const receipts = findReceipts(cwd);
-  if (receipts.length > 0) defer(`${receipts.length} run receipt(s) on disk — the run started`, "receipt-present");
-
-  const census = workCensus(events);
-
-  // ── The `work-done` fail-open is GONE, and its removal is the point.
-  //
-  // WHAT IT USED TO DO: `if (census.work_calls > 2) defer("the session did work by other means")`.
-  // The stated rationale was that a user may have run the harness steps by hand, or be on a
-  // pre-receipt version of the plugin.
-  //
-  // WHAT IT ACTUALLY DID, observed. `Skill(tech-lead)` was dispatched, the lane could not start,
-  // the agent hand-built the whole feature, and the hook ALLOWED the Stop on `"37 work calls — the
-  // session did work by other means"`. That session passed its own oracle and read like a clean
-  // run, with no board, no T0, no verdict and no receipt. A busy session was the one thing that
-  // could switch this gate off — so the harder the agent worked around the harness, the safer it
-  // was from the gate watching for exactly that.
-  //
-  // BOTH HALVES OF THE RATIONALE FAIL ON INSPECTION. Running the harness steps by hand starts with
-  // ``harness init run``, which writes the receipt — such a session already deferred at `receipt-present`
-  // two lines up and never reached here. And a pre-receipt plugin cannot be the one executing this
-  // hook: ``harness init run`` ships in the same install, beside the `lib/` this file imports from.
-  // Neither case needs an escape, so no replacement escape is added — an escape that cannot fire
-  // is the "row that cannot fail" this project keeps catching.
-  //
-  // WHAT KEEPS THIS SAFE is not a threshold, it is the loop guard: `stop_hook_active` defers
-  // unconditionally, so a session that genuinely did the work outside the harness costs one extra
-  // turn and then stops. One nudge, never a hang. That is the trade this gate is worth.
-  const message = typeof p.last_assistant_message === "string" ? p.last_assistant_message : "";
-  const narration = detectNarration(message);
-  const enforcement = enforcementCensus(cwd);
-
-  return {
-    verdict: "block", event: "Stop", cwd, rule: "no-receipt",
-    reason: `orchestrator dispatched, ${census.work_calls} work call(s), no run receipt` +
-      (enforcement.readable && enforcement.rows === 0 ? "; enforcement layer left zero decision rows" : ""),
-    payload: {
-      decision: "block",
-      reason: buildReason({ narration, census, enforcement }),
-    },
-  };
-  });
-}
-
-if (isMain(import.meta.url)) {
-  main();
-}

package/hooks/tier-guard.mjs

@@ -1,162 +0,0 @@
-#!/usr/bin/env node
-// Tier guard — PreToolUse hook: the committed tier's write boundary.
-//
-// Refuses an Edit/Write/MultiEdit into `shapeup/<slug>/` whose CONTENT carries a reference the
-// committed tier cannot hold — a path into the gitignored run trace, or a machine-local board id.
-// It is the same rule spec-lint's TIER-DIRECTION already enforces, asked at a different moment.
-//
-// WHY A SECOND ENFORCEMENT POINT FOR A RULE THAT WAS NEVER IN DOUBT. Four different producers wrote
-// committed files this harness's own lint then reds: the requirements registry, the ship report, the
-// project profile, the coverage clauses. The lint was right every time and caught every one of them
-// — at GATE L1b, a whole phase after the sentence was written, addressed to a worker that no longer
-// holds the context needed to rephrase it. The run pays for the round trip, and the fix lands in
-// whatever wording the next reader guesses at.
-//
-// TEACHING DOES NOT CLOSE IT, and that is measured rather than assumed. One of the four recurred
-// INSIDE A SINGLE SESSION, an hour apart, on a different line of the same file, after that same
-// author had fixed the first occurrence and watched its own lint go green. A worker carries no
-// lesson across a dispatch. So the remedy has to be a precondition the model cannot talk past, and
-// it has to speak AT THE WRITE — the one moment the writer still knows what it meant to say.
-//
-// THE PREDICATE IS IMPORTED, NEVER RESTATED. `tierLeaks` is the lint's own scanner
-// (kernel/verify/spec.mjs), so this hook cannot become narrower than the rule it fronts — which
-// would let the defect through to L1b exactly as before — nor wider, which is how a guard earns
-// being switched off. The structural suite executes both over one corpus and requires agreement.
-//
-// Design (deliberately conservative, the shape `sandbox-guard.mjs` argues for):
-//   • Fail-OPEN on everything it cannot positively prove: not a write tool, no resolvable path, a
-//     path outside `shapeup/<slug>/`, a file form the lint does not scan, or a payload carrying no
-//     content to read. A guard that blocks legitimate work gets disabled, and a disabled guard
-//     enforces nothing.
-//   • `shapeup/knowledge-base/` is OUTSIDE by construction, exactly as it is outside the lint's
-//     walk: those files are instructions read by a worker at runtime, not references a reader is
-//     expected to resolve, and the defect register they hold has every reason to quote a local path.
-//   • Fail-CLOSED only on a leak the lint would red, with the file, the line, the offending token,
-//     why it is wrong and what to write instead — all in the denial, because a denial the writer
-//     cannot act on immediately just becomes the L1b round trip with extra steps.
-//
-// WHAT IT DOES NOT COVER, stated because the gap is the same one the substrate fence has: this is a
-// PreToolUse hook, so it sees this assistant's own edit path and nothing else. A kernel subcommand
-// writing a committed file, a shell heredoc, or any other editor writes straight through it. Those
-// producers are answered where they are written; this closes the channel the four measured
-// recurrences actually came through.
-//
-// Contract: PreToolUse stdin JSON { tool_name, tool_input:{file_path, content | new_string |
-// edits[]}, cwd }. Deny via { hookSpecificOutput: { hookEventName, permissionDecision:"deny",
-// permissionDecisionReason } }.
-
-import { resolve, relative, sep } from "node:path";
-import { isMain } from "../kernel/lib/argv.mjs";
-import { SHARED } from "../kernel/lib/paths.mjs";
-import { SCANNED, tierLeaks } from "../kernel/verify/spec.mjs";
-import { runHook, readStdin, settle, projectRoot } from "./lib/decision.mjs";
-
-/** Committed-tier trees that hold instructions rather than references — outside the lint's walk. */
-const NOT_A_SLUG = new Set(["knowledge-base"]);
-
-/**
- * The (path, content) pairs one write tool call is about to commit to disk.
- *
- * THE THREE WRITE TOOLS SPELL CONTENT THREE WAYS, and a guard that reads only `content` is blind to
- * the Edit that adds the same line — which is the form the measured recurrence took, since the file
- * already existed by then.
- *
- * @param {object} toolInput - The PreToolUse `tool_input` block.
- * @returns {Array<{path:string, content:string}>} Pairs with a usable path and string content.
- */
-export function extractWrites(toolInput) {
-  const out = [];
-  const base = toolInput?.file_path;
-  if (typeof toolInput?.content === "string" && base) out.push({ path: base, content: toolInput.content });
-  if (typeof toolInput?.new_string === "string" && base) out.push({ path: base, content: toolInput.new_string });
-  if (Array.isArray(toolInput?.edits)) {
-    for (const e of toolInput.edits) {
-      const p = e?.file_path || base;
-      if (p && typeof e?.new_string === "string") out.push({ path: p, content: e.new_string });
-    }
-  }
-  return out;
-}
-
-/**
- * Is this path inside the committed tier the lint walks — `shapeup/<slug>/…`, scanned form?
- *
- * @param {string} rel - Path relative to the project root, as the lint would name it.
- * @returns {boolean} True when a leak here is a leak the lint would red.
- */
-export function inCommittedTier(rel) {
-  if (!rel || rel.startsWith("..") || rel.startsWith(sep)) return false;
-  const parts = rel.split(/[\\/]/);
-  // `shapeup/<slug>/<file>` — the lint walks a slug's tree, so a file at the tier root belongs to
-  // no run and is left alone, and `knowledge-base` is a sibling of the slugs, not one of them.
-  if (parts[0] !== SHARED || parts.length < 3 || NOT_A_SLUG.has(parts[1])) return false;
-  return SCANNED.test(rel);
-}
-
-async function main() {
-  await runHook("tier-guard", async () => {
-    const raw = await readStdin();
-    let p;
-    /** Fail-open, with the reason on the record (hooks/lib/decision.mjs). */
-    const defer = (reason, rule) => settle({
-      verdict: "allow", event: "PreToolUse", tool: p?.tool_name ?? null, cwd: p?.cwd, reason, rule,
-    });
-    try { p = JSON.parse(raw || "{}"); }
-    catch (e) { settle({ verdict: "error", event: "PreToolUse", reason: `unparseable payload: ${e.message}` }); }
-
-    if (!["Edit", "Write", "MultiEdit"].includes(p.tool_name)) {
-      defer(`${p.tool_name ?? "no tool_name"} is not a write tool — out of scope`, "not-write-tool");
-    }
-
-    // The shell's cwd is where the call fired; the tier lives at the project root. Same split the
-    // substrate fence has to make, and for the same reason: a worker that `cd`s into a sub-folder
-    // must not thereby leave the tier unguarded. Raw tool paths still resolve against the shell.
-    const cwd = p.cwd || process.cwd();
-    const root = projectRoot(cwd);
-
-    const writes = extractWrites(p.tool_input);
-    if (writes.length === 0) defer("no readable path+content pair in the tool input", "no-content");
-
-    const inTier = writes
-      .map((w) => ({ ...w, rel: relative(root, resolve(cwd, w.path)) }))
-      .filter((w) => inCommittedTier(w.rel));
-    if (inTier.length === 0) defer(`${writes.length} write(s), none inside ${SHARED}/<slug>/ in a scanned form`, "not-committed-tier");
-
-    const blocked = [];
-    for (const w of inTier) {
-      // THE TOKEN IS QUOTED BACK, which the lint's own message does not do and does not need to —
-      // it reports against a file on disk the reader can open at that line. Here the line does not
-      // exist yet, so "line 1 points into the local tier" leaves the writer hunting through a
-      // fragment it is holding in its head. Naming the exact string is the difference between a
-      // denial that is acted on and one that is retried verbatim.
-      for (const leak of tierLeaks(w.content)) blocked.push(`${w.rel}:${leak.line} — \`${leak.token}\` ${leak.detail}`);
-    }
-
-    if (blocked.length === 0) {
-      defer(`${inTier.length} committed-tier write(s) carry no tier-direction leak — permitted`, "tier-clean");
-    }
-
-    return {
-      verdict: "deny", event: "PreToolUse", tool: p.tool_name, subject: inTier[0].rel, cwd: root,
-      rule: "tier-direction",
-      reason: `${blocked.length} tier-direction leak(s) refused at the write boundary: ${blocked.join("; ")}`,
-      payload: {
-        hookSpecificOutput: {
-          hookEventName: "PreToolUse",
-          permissionDecision: "deny",
-          permissionDecisionReason:
-            "Tier guard (TIER-DIRECTION) — this write would put a reference into the committed tier that " +
-            "cannot survive the trip to another machine:\n" +
-            `${blocked.join("\n")}\n` +
-            `Refused here rather than at GATE L1b, where spec-lint reds the same file after the phase is over. ` +
-            "Rephrase the line now: cite the committed artifact, the use case or the scope_id, or describe the " +
-            "tier without naming a path.",
-        },
-      },
-    };
-  });
-}
-
-if (isMain(import.meta.url)) {
-  main();
-}