sneakoscope 7.0.2 → 7.0.5

package/dist/core/hooks-runtime.js

@@ -1,7 +1,7 @@
 import path from 'node:path';
-import { projectRoot, readJson, readText, writeJsonAtomic, appendJsonl, nowIso, runProcess, sha256, packageRoot, tmpdir } from './fsx.js';
+import { projectRoot, readJson, writeJsonAtomic, appendJsonl, nowIso, runProcess, sha256, packageRoot, tmpdir } from './fsx.js';
 import { looksInteractiveCommand, interactiveCommandReason } from './no-question-guard.js';
-import { loadStateForSession, missionDir, setCurrent, updateCurrentIfMissionAndRun } from './mission.js';
+import { loadStateForSession, missionDir, sessionStateKey, setCurrent, stateFileForSession } from './mission.js';
 import { checkDbOperation, dbBlockReason, handleMadSksUserConfirmation } from './db-safety.js';
 import { maybeRecordMadSksSqlPlaneToolResultFromToolUse } from './mad-sks/sql-plane/result-lifecycle.js';
 import { checkHarnessModification, harnessGuardBlockReason, isHarnessSourceProject } from './harness-guard.js';
@@ -10,46 +10,45 @@ import { classifyMadSksShellCommand } from './mad-sks/write-guard.js';
 import { activeRouteContext, evaluateStop, prepareRoute, promptPipelineContext as routePipelineContext, recordContext7Evidence, recordSubagentEvidence, routePrompt } from './pipeline.js';
 import { localizedFinalizationReason } from './language-preference.js';
 import { classifyToolError } from './evaluation.js';
-import { dollarCommand, routeRequiresSubagents, stripVisibleDecisionAnswerBlocks } from './routes.js';
+import { dollarCommand, managedSkillNamesForPrompt, stripVisibleDecisionAnswerBlocks } from './routes.js';
 import { coreEngineeringDirectiveReferenceText } from './lean-engineering-policy.js';
 import { scanAgentTextForRecursion } from './agents/agent-recursion-guard.js';
 import { evaluateLoopContinuation } from './loops/loop-continuation-enforcer.js';
 import { diagnosticPromptAllowedDuringNoQuestions } from './routes/diagnostic-allowlist.js';
-import { closeWorkOrderLedgerForRouteResult } from './work-order-ledger.js';
-import { maybeFinalizeRoute } from './proof/auto-finalize.js';
-import { validateRouteCompletionProof } from './proof/route-proof-gate.js';
 import { maybeReconcileProjectSkillsPreflight } from './hooks-runtime/skill-reconcile-preflight.js';
 import { codePackFreshnessNote } from './hooks-runtime/code-pack-freshness-preflight.js';
 import { claimHookInvocation } from './hooks-runtime/hook-invocation-dedupe.js';
 import { armLightTurnStopBypass, clearLightTurnStopBypass, consumeLightTurnStopBypass, hasMatchingLightTurnStopBypass } from './hooks-runtime/light-turn.js';
 import { evaluateHookNarutoDecisionGate, looksLikeActiveContinuationPrompt } from './hooks-runtime/naruto-decision-gate.js';
+import { ensureOfficialSubagentArtifactDirConfined, officialSubagentArtifactDir, recordAndRefreshSubagentEvidence, refreshOfficialSubagentCompletionArtifacts } from './hooks-runtime/official-subagent-lifecycle.js';
 import { finalizationRepeatDecision } from './hooks-runtime/stop-repeat-guard.js';
+import { activeNarutoParentLaunchMissionId, claimStandaloneParentHostCapabilityRuntime } from './hooks-runtime/standalone-parent-host-capability.js';
 import { classifyTaskProfile } from './runtime/task-profile.js';
 import { resolveSubagentThreadBudget } from './subagents/thread-budget.js';
 import { readOfficialSubagentConfig } from './subagents/official-subagent-config.js';
 import { withFileLock } from './locks/file-lock.js';
-import { NARUTO_PARENT_EFFORT, NARUTO_PARENT_MODEL } from './subagents/model-policy.js';
-import { officialSubagentRolePlan } from './subagents/agent-catalog.js';
-import { recordOfficialSubagentParentOutcomesTelemetry, recordOfficialSubagentZellijTelemetry } from './zellij/zellij-official-subagent-telemetry.js';
-import { bindTrustworthySubagentParentSummaryToRun, normalizeSubagentEvent, normalizeSubagentParentSummary, persistOrReuseTrustworthySubagentParentSummary, readSubagentEvents, recordSubagentEvent, SUBAGENT_EVIDENCE_FILENAME, SUBAGENT_PARENT_SUMMARY_FILENAME, writeSubagentEvidence } from './subagents/subagent-evidence.js';
-import { officialSubagentPreparationInProgress, withOfficialSubagentLifecycleLock, writeNarutoGate } from './subagents/official-subagent-preparation.js';
-import { effectiveSubagentTarget, normalizeLegacySubagentCountFields, refreshSubagentWaveLifecycle, subagentCountContractBlockers } from './subagents/wave-lifecycle.js';
-import { buildWaveParentGuidance, renderWaveParentGuidance } from './subagents/wave-parent-guidance.js';
-import { managedOfficialSubagentRoleByName } from './managed-assets/managed-assets-manifest.js';
-import { SSOT_GUARD_ARTIFACT, validateSsotGuardArtifact } from './safety/ssot-guard.js';
+import { buildBoundWaveParentGuidance, renderWaveParentGuidance } from './subagents/wave-parent-guidance.js';
+import { renderAuthoritativeSksSkillContext, resolveAuthoritativeSksSkillSources } from './codex-native/sks-skill-paths.js';
+import { authoritativeSksSkillResolutionBlockers, clearSubagentSkillAvailabilityGuards, persistSubagentSkillAvailabilityBlocker, renderSubagentSkillAvailabilityHandoff, subagentSkillAvailabilityPreToolBlockReason } from './hooks-runtime/subagent-skill-availability.js';
+import { HOST_CAPABILITY_HOOK_EVIDENCE_FILENAME, HOST_CAPABILITY_HOOK_OBSERVATIONS_FILENAME, HOST_CAPABILITY_HOOK_RUNTIME_FILENAME, acasHostToolName, authorizeAndMergeHostCapabilityPreToolObservation, buildHostCapabilityEvidenceFromHookObservations, explicitlyDeniedHostCapabilityTool, mergeHostCapabilityPostToolObservation, requestHostCapabilities, resolveHostCapabilityHookRuntimeBinding, sanitizeHostCapabilityPostToolUse, sanitizeHostCapabilityPreToolUse } from './agent-bridge/host-capability-runtime.js';
 const LIGHT_ROUTE_STOP_ARTIFACT = 'light-route-stop.json';
 const CODEX_GIT_ACTION_STOP_ARTIFACT = 'codex-git-action-stop-bypass.json';
 const CODEX_GIT_ACTION_STOP_TTL_MS = 15 * 60 * 1000;
 const UPDATE_CHECK_HOOK_INVOCATION_POLICY = 'function-only:no-runSksUpdateCheck-call-in-hooks';
-// Update checks stay function-only in hooks: the policy marker above is checked
-// by release readiness so ordinary Codex hook flow cannot grow a hidden update
-// prompt path.
 import { loadHookPayload, normalizeHookResult, visibleHookMessage } from './hooks-runtime/hook-io.js';
-import { codexGitActionMetadataSignal, codexGitActionMetadataText, compactAnswerContext, conversationId, explicitConversationId, extractCommand, extractLastMessage, extractUserPrompt, hookTurnId, looksLikeCodexGitAction, looksLikeCodexGitActionStopCompletion, looksLikeCodexUiSettingsEvent, looksLikeMadSksConfirmationPrompt, observedParentModel, observedParentModelMismatch, toolFailed } from './hooks-runtime/payload-signals.js';
+import { codexGitActionMetadataSignal, codexGitActionMetadataText, compactAnswerContext, conversationId, explicitConversationId, extractCommand, extractLastMessage, extractUserPrompt, hookTurnId, looksLikeCodexGitAction, looksLikeCodexGitActionStopCompletion, looksLikeCodexUiSettingsEvent, looksLikeMadSksConfirmationPrompt, observedParentModel, toolFailed } from './hooks-runtime/payload-signals.js';
 import { interruptedToolOutputRecoveryBlockReason, missingToolOutputCallId, missingToolOutputCallIdFromPayload, quarantineMissingToolOutput, readToolOutputQuarantine } from './hooks-runtime/tool-output-quarantine.js';
+import { activeAuthoritativeSksSkillRefresh, activeGoalOverlayContext, attachAuthoritativeSksSkillContext, authoritativeSksSkillAdmission, hookActiveSkillContextRefresh, isBlockingClarificationAwaiting, looksLikeClarificationCancel, routeBypassesActiveContext, routeIsGitOnly, selectedSksSkillNamesForActiveState, shouldPrepareFreshRouteOnActivePrompt, standaloneParentManagedSkillNames } from './hooks-runtime/hook-context.js';
+import { sealedSubagentRoutingContext, subagentRouteContext } from './hooks-runtime/subagent-context.js';
 export { loadHookPayload, normalizeHookResult };
+export { refreshOfficialSubagentCompletionArtifacts };
 async function loadState(root, payload = {}) {
-    return loadStateForSession(root, conversationId(payload));
+    const sessionKey = conversationId(payload);
+    if (!explicitConversationId(payload))
+        return loadStateForSession(root, sessionKey);
+    const hashed = sessionStateKey(sessionKey);
+    const sessionState = await readJson(stateFileForSession(root, sessionKey), null).catch(() => null);
+    return sessionState ? { ...sessionState, _session_key: sessionState._session_key || hashed } : {};
 }
 function isNoQuestionRunning(state) {
     return (state.mode === 'RESEARCH' && state.phase === 'RESEARCH_RUNNING_NO_QUESTIONS')
@@ -96,10 +95,6 @@ export async function evaluateHookPayload(name, payload = {}, opts = {}) {
             hook: name
         }).catch(() => null);
     }
-    // Hook decisions use persisted session state. Codex hook payloads do not
-    // define a trusted `state` field; accepting a partial/spoofed value can hide
-    // an active mission or bypass route gates. Explicit opts.state remains for
-    // internal replay and focused tests.
     const loadedState = opts.state || await loadState(root, payload);
     const state = { ...loadedState, _session_key: loadedState?._session_key || sessionKey };
     const noQuestion = isNoQuestionRunning(state);
@@ -114,7 +109,11 @@ export async function evaluateHookPayload(name, payload = {}, opts = {}) {
     });
     const withNarutoDecision = (result) => ({ ...result, sksNarutoDecision });
     if (name === 'user-prompt-submit') {
-        return withNarutoDecision(await hookUserPrompt(root, state, payload, noQuestion, sessionKey));
+        const result = await hookUserPrompt(root, state, payload, noQuestion, sessionKey);
+        return withNarutoDecision(await attachAuthoritativeSksSkillContext(root, state, payload, result));
+    }
+    if (name === 'session-start' || name === 'pre-compact' || name === 'post-compact') {
+        return withNarutoDecision(await hookActiveSkillContextRefresh(root, state, name));
     }
     if (name === 'pre-tool')
         return withNarutoDecision(await hookPreTool(root, state, payload, noQuestion, sessionKey));
@@ -132,192 +131,68 @@ export async function evaluateHookPayload(name, payload = {}, opts = {}) {
 }
 async function hookSubagentStart(root, state, payload = {}, sessionKey = null) {
     const artifactDir = officialSubagentArtifactDir(root, state, sessionKey);
-    await recordAndRefreshSubagentEvidence(root, artifactDir, state, payload, 'SubagentStart').catch(() => null);
+    const sessionArtifactDir = officialSubagentArtifactDir(root, {}, sessionKey);
+    const artifactDirBlockers = [];
+    const artifactDirSafe = await ensureOfficialSubagentArtifactDirConfined(root, artifactDir)
+        .then(() => true)
+        .catch(() => false);
+    if (!artifactDirSafe)
+        artifactDirBlockers.push('subagent_skill_availability_artifact_dir_unsafe');
+    await clearSubagentSkillAvailabilityGuards(root, payload, artifactDir).catch(() => null);
     const config = await readOfficialSubagentConfig(root);
     const budget = resolveSubagentThreadBudget({ configuredMaxThreads: config.maxThreads });
     const active = subagentRouteContext(state);
-    const routingContext = await sealedSubagentRoutingContext(artifactDir, payload);
+    const routingContext = artifactDirSafe ? await sealedSubagentRoutingContext(artifactDir, payload) : '';
     const resourceGuard = [
-        `SKS subagent policy: Codex [agents].max_threads is ${budget.maxThreads}.`,
-        'Use max_depth=1. Subagents must not spawn subagents.',
+        `SKS Naruto policy: max_threads frame budget is ${budget.maxThreads} (cap, not a spawn target).`,
+        'GPT-5.6 four profiles are routing lanes, not an agent-count cap.',
+        'Use max_depth=1. Naruto children must not spawn children.',
         'Do not duplicate an already assigned slice.',
         'Parallel writes require disjoint paths; serialize overlapping paths.',
-        'Finish only your assigned slice, return a concise result, then stop so the root parent can close this thread.'
+        'Finish only your assigned slice, return a concise result, then stop so the Naruto parent can close this thread.'
     ].join(' ');
-    const additionalContext = [coreEngineeringDirectiveReferenceText(), resourceGuard, routingContext, active].filter(Boolean).join('\n\n');
-    return { continue: true, additionalContext };
-}
-async function sealedSubagentRoutingContext(artifactDir, payload = {}) {
-    const plan = await readJson(path.join(artifactDir, 'subagent-plan.json'), null).catch(() => null);
-    if (!plan || plan.workflow !== 'official_codex_subagent')
-        return '';
-    const agentName = extractSubagentAgentName(payload);
-    const agents = plan.agents && typeof plan.agents === 'object' ? plan.agents : {};
-    const planned = agentName && agents[agentName] ? agents[agentName] : null;
-    const role = agentName ? managedOfficialSubagentRoleByName(agentName) : null;
-    const model = String(planned?.routed_model || planned?.model || role?.model || '').trim();
-    const effort = String(planned?.routed_model_reasoning_effort || planned?.model_reasoning_effort || role?.model_reasoning_effort || '').trim();
-    if (!agentName && !model)
-        return '';
-    return [
-        'SKS sealed child routing:',
-        agentName ? `- custom agent: ${agentName}` : null,
-        model ? `- model: ${model}` : null,
-        effort ? `- model_reasoning_effort: ${effort}` : null,
-        '- keep this sealed profile; do not retarget model/effort or spawn nested agents'
-    ].filter(Boolean).join('\n');
-}
-function extractSubagentAgentName(payload = {}) {
-    const candidates = [
-        payload.agent_type,
-        payload.agentType,
-        payload.subagent_type,
-        payload.subagentType,
-        payload.agent_name,
-        payload.agentName,
-        payload.agent,
-        payload.role,
-        payload.payload?.agent_type,
-        payload.payload?.agentType,
-        payload.payload?.subagent_type,
-        payload.data?.agent_type,
-        payload.input?.agent_type
+    const skillNames = selectedSksSkillNamesForActiveState(state);
+    const resolution = skillNames.length
+        ? await resolveAuthoritativeSksSkillSources({ root, skillNames }).catch(() => null)
+        : null;
+    const skillBlockers = [
+        ...artifactDirBlockers,
+        ...(skillNames.length ? authoritativeSksSkillResolutionBlockers(resolution) : [])
     ];
-    for (const value of candidates) {
-        const name = String(value || '').trim();
-        if (name)
-            return name;
+    try {
+        await persistSubagentSkillAvailabilityBlocker({
+            root,
+            artifactDir,
+            sessionArtifactDir,
+            state,
+            payload,
+            blockers: skillBlockers
+        });
     }
-    return '';
-}
-function subagentRouteContext(state = {}) {
-    if (!state?.route && !state?.mode)
-        return '';
-    const route = state.route_command || state.route || state.mode;
-    const mission = state.mission_id ? ` for mission ${state.mission_id}` : '';
-    const artifacts = state.mission_id
-        ? ` Read only the route artifacts relevant to your assigned slice under .sneakoscope/missions/${state.mission_id}/.`
-        : '';
-    const databaseBoundary = String(state.mode || state.route || '').toUpperCase() === 'DB'
-        ? ' Keep database inspection read-only unless the parent supplied a separately sealed mutation contract.'
-        : '';
-    return `You are a child thread on ${route}${mission}. Execute only the slice assigned by the parent.${artifacts} Do not spawn or delegate other agents, wait for sibling threads, integrate sibling results, close the parent route, or author the sks.subagent-parent-summary.v1 parent result. Return a concise slice result to the parent.${databaseBoundary}`;
+    catch (error) {
+        const blocker = error instanceof Error
+            && error.message === 'subagent_skill_availability_blocker_artifact_write_failed'
+            ? 'subagent_skill_availability_blocker_artifact_write_failed'
+            : 'subagent_skill_availability_guard_persistence_failed';
+        skillBlockers.push(blocker);
+    }
+    if (artifactDirSafe) {
+        await recordAndRefreshSubagentEvidence(root, state, payload, 'SubagentStart', sessionKey).catch(() => null);
+    }
+    const skillContext = skillBlockers.length
+        ? renderSubagentSkillAvailabilityHandoff(skillBlockers)
+        : resolution
+            ? renderAuthoritativeSksSkillContext(resolution)
+            : '';
+    const additionalContext = [coreEngineeringDirectiveReferenceText(), resourceGuard, routingContext, active, skillContext].filter(Boolean).join('\n\n');
+    return { continue: true, additionalContext, ...(skillBlockers.length ? { silent: true } : {}) };
 }
 async function hookSubagentStop(root, state, payload = {}, sessionKey = null) {
-    const artifactDir = officialSubagentArtifactDir(root, state, sessionKey);
-    await recordAndRefreshSubagentEvidence(root, artifactDir, state, payload, 'SubagentStop').catch(() => null);
-    // SubagentStop is evidence collection only. It must never reuse the parent
-    // Stop hook's route gate or block a child thread from returning its result.
+    await recordAndRefreshSubagentEvidence(root, state, payload, 'SubagentStop', sessionKey).catch(() => null);
+    await clearSubagentSkillAvailabilityGuards(root, payload, officialSubagentArtifactDir(root, state, sessionKey)).catch(() => null);
     return { continue: true, silent: true };
 }
-function officialSubagentArtifactDir(root, state = {}, sessionKey = null) {
-    if (state?.mission_id)
-        return missionDir(root, state.mission_id);
-    return path.join(root, '.sneakoscope', 'state', 'subagents', sha256(String(sessionKey || 'default')).slice(0, 32));
-}
-async function recordAndRefreshSubagentEvidence(root, artifactDir, state, payload, eventName) {
-    return withOfficialSubagentLifecycleLock(artifactDir, async () => {
-        if (await officialSubagentPreparationInProgress(artifactDir))
-            return null;
-        const plan = await readJson(path.join(artifactDir, 'subagent-plan.json'), {});
-        const workflowRunId = String(plan?.workflow_run_id || state?.official_subagent_run_id || '').trim();
-        const stateRunId = String(state?.official_subagent_run_id || '').trim();
-        if (!workflowRunId || (stateRunId && stateRunId !== workflowRunId))
-            return null;
-        const terminalGate = plan?.workflow === 'official_codex_subagent'
-            ? await readJson(path.join(artifactDir, 'naruto-gate.json'), null).catch(() => null)
-            : null;
-        const terminalRunId = String(terminalGate?.workflow_run_id || '').trim();
-        if (workflowRunId
-            && terminalRunId === workflowRunId
-            && terminalGate?.passed === true
-            && terminalGate?.terminal === true) {
-            return null;
-        }
-        const normalizedInputEvent = normalizeSubagentEvent(payload, eventName);
-        const explicitRunId = normalizedInputEvent?.run_id || null;
-        if (explicitRunId && explicitRunId !== workflowRunId)
-            return null;
-        let boundRunId = explicitRunId;
-        if (!boundRunId && eventName === 'SubagentStop' && normalizedInputEvent?.thread_id) {
-            const priorEvents = await readSubagentEvents(artifactDir);
-            const matchingStartRuns = [...new Set(priorEvents
-                    .filter((row) => row.event_name === 'SubagentStart'
-                    && row.thread_id === normalizedInputEvent.thread_id
-                    && Boolean(row.run_id))
-                    .map((row) => row.run_id))];
-            boundRunId = matchingStartRuns.length === 1
-                ? matchingStartRuns[0] || null
-                : null;
-            if (!boundRunId)
-                return null;
-        }
-        else if (!boundRunId) {
-            boundRunId = workflowRunId || null;
-        }
-        const eventPayload = boundRunId && payload && typeof payload === 'object' && !Array.isArray(payload)
-            ? { ...payload, workflow_run_id: boundRunId }
-            : payload;
-        const event = await recordSubagentEvent(artifactDir, eventPayload, eventName);
-        if (!event)
-            return null;
-        const zellijTelemetry = await recordOfficialSubagentZellijTelemetry({
-            root,
-            routeMissionId: plan?.mission_id || state?.mission_id || null,
-            event,
-            payload: eventPayload,
-            plan
-        }).catch(async (error) => {
-            await appendJsonl(path.join(artifactDir, 'zellij-telemetry-warnings.jsonl'), {
-                ts: nowIso(),
-                warning: 'official_subagent_zellij_telemetry_failed',
-                event_name: eventName,
-                thread_id: event.thread_id,
-                error: String(error?.message || error)
-            }).catch(() => null);
-            return null;
-        });
-        if (zellijTelemetry?.blocker) {
-            await appendJsonl(path.join(artifactDir, 'zellij-telemetry-warnings.jsonl'), {
-                ts: nowIso(),
-                warning: 'official_subagent_zellij_telemetry_incomplete',
-                event_name: eventName,
-                thread_id: event.thread_id,
-                blocker: zellijTelemetry.blocker,
-                failed_mission_ids: 'failed_mission_ids' in zellijTelemetry ? zellijTelemetry.failed_mission_ids : []
-            }).catch(() => null);
-        }
-        const lifecycle = await refreshSubagentWaveLifecycle(artifactDir, { plan, event }).catch(() => null);
-        const refreshedPlan = lifecycle ? { ...plan, wave_lifecycle: lifecycle } : plan;
-        const existing = await readJson(path.join(artifactDir, SUBAGENT_EVIDENCE_FILENAME), {});
-        const parentSummary = await readJson(path.join(artifactDir, SUBAGENT_PARENT_SUMMARY_FILENAME), null);
-        const countTarget = effectiveSubagentTarget(refreshedPlan, lifecycle?.cumulative_started || 0);
-        const requestedSubagents = countTarget.requestedSubagents
-            || Number(state?.requested_subagents || existing?.requested_subagents || 0);
-        if (!Number.isFinite(requestedSubagents) || requestedSubagents < 1)
-            return event;
-        const evidence = await writeSubagentEvidence(artifactDir, {
-            requestedSubagents,
-            countPolicy: countTarget.countPolicy,
-            targetSubagents: countTarget.targetSubagents,
-            parentSummary,
-            parentSummaryPresent: parentSummary !== null,
-            workflowStatus: 'running',
-            preparationOnly: false,
-            runId: workflowRunId || null,
-            additionalBlockers: Array.isArray(plan?.config_blockers)
-                ? [
-                    ...plan.config_blockers.map((item) => `official_subagent_config:${String(item)}`),
-                    ...subagentCountContractBlockers(refreshedPlan, lifecycle?.cumulative_started || 0)
-                ]
-                : subagentCountContractBlockers(refreshedPlan, lifecycle?.cumulative_started || 0)
-        });
-        return event;
-    });
-}
 async function hookUserPrompt(root, state, payload, noQuestion, sessionKey = null) {
-    // A receipt is scoped to exactly one submitted turn. Every later prompt,
-    // including Codex App git/settings events, invalidates it before returning.
     await clearLightTurnStopBypass(root, { sessionKey }).catch(() => undefined);
     const submittedPrompt = stripVisibleDecisionAnswerBlocks(extractUserPrompt(payload));
     const explicitSession = explicitConversationId(payload);
@@ -346,6 +221,23 @@ async function hookUserPrompt(root, state, payload, noQuestion, sessionKey = nul
     }
     const parentLaunchMissionId = activeNarutoParentLaunchMissionId();
     if (parentLaunchMissionId) {
+        const parentSkillNames = await standaloneParentManagedSkillNames(root, parentLaunchMissionId, state);
+        const skillAdmission = await authoritativeSksSkillAdmission(root, parentSkillNames);
+        if (skillAdmission.blocked)
+            return skillAdmission.blocked;
+        const parentHostCapability = await claimStandaloneParentHostCapabilityRuntime({
+            root,
+            missionId: parentLaunchMissionId,
+            sessionScope: sessionKey,
+            explicitSession
+        });
+        if (parentHostCapability.blocker) {
+            return {
+                decision: 'block',
+                permissionDecision: 'deny',
+                reason: `SKS blocked the standalone Naruto parent before host tool execution: ${parentHostCapability.blocker}`
+            };
+        }
         const attachedState = {
             ...state,
             mission_id: parentLaunchMissionId,
@@ -353,8 +245,11 @@ async function hookUserPrompt(root, state, payload, noQuestion, sessionKey = nul
             route: 'Naruto',
             route_command: '$Naruto',
             route_closed: false,
+            required_skills: parentSkillNames,
             subagents_required: true,
-            native_sessions_required: false
+            native_sessions_required: false,
+            official_subagent_run_id: parentHostCapability.workflowRunId || state?.official_subagent_run_id || null,
+            session_scope: sessionKey
         };
         await setCurrent(root, attachedState, { sessionKey, replace: true });
         const activeContext = await activeRouteContext(root, attachedState);
@@ -400,6 +295,9 @@ async function hookUserPrompt(root, state, payload, noQuestion, sessionKey = nul
             return { continue: true, silent: true, sksTaskProfile: taskProfile };
         }
         if (!explicitCommand && !clarificationPending && !madConfirmationPrompt && !activeContinuation && lightRoute?.id === 'Answer') {
+            const skillAdmission = await authoritativeSksSkillAdmission(root, lightRoute.requiredSkills || ['answer', 'honest-mode']);
+            if (skillAdmission.blocked)
+                return skillAdmission.blocked;
             const turnId = hookTurnId(payload);
             if (turnId) {
                 await armLightTurnStopBypass(root, {
@@ -428,7 +326,6 @@ async function hookUserPrompt(root, state, payload, noQuestion, sessionKey = nul
                 systemMessage: visibleHookMessage('user-prompt-submit', activeContext)
             };
         }
-        await maybeReconcileProjectSkillsPreflight(root).catch(() => null);
         const updateContext = '';
         const command = dollarCommand(prompt);
         const route = routePrompt(prompt);
@@ -439,6 +336,10 @@ async function hookUserPrompt(root, state, payload, noQuestion, sessionKey = nul
                 systemMessage: `SKS: ${route.command} git action bypassed pipeline route gates.`
             };
         }
+        const skillAdmission = await authoritativeSksSkillAdmission(root, managedSkillNamesForPrompt(route, prompt));
+        if (skillAdmission.blocked)
+            return skillAdmission.blocked;
+        await maybeReconcileProjectSkillsPreflight(root).catch(() => null);
         const bypassActiveRoute = routeBypassesActiveContext(route);
         const goalOverlay = activeGoalOverlayContext(state, route);
         const prepareFreshRoute = shouldPrepareFreshRouteOnActivePrompt(prompt, route, {
@@ -484,54 +385,28 @@ async function hookUserPrompt(root, state, payload, noQuestion, sessionKey = nul
         reason: 'SKS no-question/no-interruption mode is active. User prompt has been queued until the run completes.'
     };
 }
-function routeBypassesActiveContext(route = null) {
-    return ['DFix', 'Answer', 'Commit', 'CommitAndPush', 'Wiki', 'ComputerUse'].includes(String(route?.id || ''));
-}
-function routeIsGitOnly(route = null) {
-    return ['Commit', 'CommitAndPush'].includes(String(route?.id || ''));
-}
-function shouldPrepareFreshRouteOnActivePrompt(prompt, route = null, opts = {}) {
-    if (!route || opts.command || opts.bypassActiveRoute || opts.goalOverlay)
-        return false;
-    if (looksLikeActiveContinuationPrompt(prompt))
-        return false;
-    return routeRequiresSubagents(route, prompt);
-}
-function isClarificationAwaiting(state = {}) {
-    const phase = String(state.phase || '');
-    const stopGate = String(state.stop_gate || '');
-    const gateAwaiting = phase.includes('CLARIFICATION_AWAITING_ANSWERS') || stopGate === 'clarification-gate';
-    if (!gateAwaiting)
-        return false;
-    if (!state?.mission_id)
-        return false;
-    if (state.ambiguity_gate_required !== true || state.ambiguity_gate_passed === true)
-        return false;
-    return Boolean(state.clarification_required || state.implementation_allowed === false);
-}
-function activeNarutoParentLaunchMissionId() {
-    return process.env.SKS_NARUTO_PARENT_LAUNCH === '1'
-        ? String(process.env.SKS_NARUTO_PARENT_MISSION_ID || '').trim()
-        : '';
-}
-function isBlockingClarificationAwaiting(state = {}) {
-    return isClarificationAwaiting(state);
-}
-function looksLikeClarificationCancel(prompt = '') {
-    return /^(cancel|reset|restart|new mission|새로|취소|중단|리셋|다시 시작)\b/i.test(String(prompt || '').trim());
-}
-function activeGoalOverlayContext(state = {}, route = null) {
-    if (state.mode !== 'GOAL' || !state.mission_id)
-        return '';
-    if (!route || route.id === 'Goal' || route.id === 'DFix' || route.id === 'Answer')
-        return '';
-    return [
-        `Legacy SKS Goal state ${state.mission_id} is non-authoritative and must not be updated.`,
-        `Do not let it hijack this new ${route.command || '$SKS'} prompt. The newly prepared route mission and gate are authoritative for this turn.`,
-        'Codex native Goal is the only persisted Goal owner; use native controls only when the user explicitly returns to Goal.'
-    ].join('\n');
-}
 async function hookPreTool(root, state, payload, noQuestion, sessionKey = null) {
+    const skillAvailabilityBlock = await subagentSkillAvailabilityPreToolBlockReason(root, payload, officialSubagentArtifactDir(root, state, sessionKey), {
+        missionId: state?.mission_id,
+        workflowRunId: state?.official_subagent_run_id
+    }).catch((error) => {
+        const code = error instanceof Error && error.message === 'subagent_skill_availability_guard_invalid'
+            ? 'subagent_skill_availability_guard_invalid'
+            : 'subagent_skill_availability_guard_check_failed';
+        return `SKS blocked this child tool call because managed skill availability failed (${code}). Return the blocker to the root parent without using tools.`;
+    });
+    if (skillAvailabilityBlock) {
+        return { decision: 'block', permissionDecision: 'deny', reason: skillAvailabilityBlock };
+    }
+    const skillRefresh = await activeAuthoritativeSksSkillRefresh(root, state);
+    if (skillRefresh.blocked) {
+        return {
+            decision: 'block',
+            permissionDecision: 'deny',
+            reason: skillRefresh.blocked.reason,
+            systemMessage: skillRefresh.blocked.systemMessage
+        };
+    }
     if (needsMutationSafetyCheck(payload)) {
         const madSksImmutableDecision = await checkMadSksImmutableModification(root, state, payload);
         if (madSksImmutableDecision.action === 'block') {
@@ -555,12 +430,18 @@ async function hookPreTool(root, state, payload, noQuestion, sessionKey = null)
         return agentRecursionDecision;
     if (noQuestion && looksInteractiveCommand(command))
         return { decision: 'block', reason: interactiveCommandReason(command) };
+    const hostCapabilityDecision = await enforceHostCapabilityPreTool(root, state, payload, sessionKey);
+    if (hostCapabilityDecision && hostCapabilityDecision.continue !== true)
+        return hostCapabilityDecision;
     const waveGuidance = await parentWaveGuidanceContext(root, state, sessionKey).catch(() => '');
-    if (waveGuidance) {
+    const additionalContext = [skillRefresh.context, waveGuidance].filter(Boolean).join('\n\n');
+    if (additionalContext) {
         return {
             continue: true,
-            additionalContext: waveGuidance,
-            systemMessage: visibleHookMessage('pre-tool', 'SKS Naruto wave lifecycle requires root-parent follow-up.')
+            additionalContext,
+            ...(waveGuidance
+                ? { systemMessage: visibleHookMessage('pre-tool', 'SKS Naruto wave lifecycle requires root-parent follow-up.') }
+                : { silent: true })
         };
     }
     return { continue: true };
@@ -573,15 +454,14 @@ async function parentWaveGuidanceContext(root, state = {}, sessionKey = null) {
         || state?.subagents_required === true;
     if (!isNaruto)
         return '';
-    // Child worker hooks must not receive parent wave spawn instructions.
     if (agentWorkerHookContext(state, {}))
         return '';
     const artifactDir = officialSubagentArtifactDir(root, state, sessionKey);
     const plan = await readJson(path.join(artifactDir, 'subagent-plan.json'), null).catch(() => null);
-    if (!plan || plan.workflow !== 'official_codex_subagent')
-        return '';
-    const lifecycle = plan.wave_lifecycle || null;
-    const guidance = lifecycle?.parent_guidance || buildWaveParentGuidance(lifecycle);
+    const guidance = buildBoundWaveParentGuidance(plan, {
+        missionId: state?.mission_id,
+        workflowRunId: state?.official_subagent_run_id
+    });
     if (!guidance?.required)
         return '';
     return renderWaveParentGuidance(guidance);
@@ -615,6 +495,7 @@ function agentWorkerHookContext(state = {}, payload = {}) {
 async function hookPostTool(root, state, payload, noQuestion, sessionKey = null) {
     state = { ...state, _session_key: state?._session_key || sessionKey };
     await Promise.all([
+        recordHostCapabilityPostTool(root, state, payload, sessionKey).catch(() => null),
         recordMadSksSqlPlanePostToolLifecycle(root, state, payload).catch(() => null),
         recordContext7Evidence(root, state, payload).catch(() => null),
         recordSubagentEvidence(root, state, payload).catch(() => null),
@@ -630,6 +511,134 @@ async function hookPostTool(root, state, payload, noQuestion, sessionKey = null)
     }
     return { continue: true };
 }
+async function enforceHostCapabilityPreTool(root, state = {}, payload = {}, sessionKey = null) {
+    const tool = acasHostToolName(payload.tool_name);
+    if (!tool)
+        return null;
+    if (explicitlyDeniedHostCapabilityTool(tool)) {
+        return {
+            decision: 'block',
+            permissionDecision: 'deny',
+            reason: `SKS denied acas-tools.${tool}; this tool is explicitly denied for model execution.`
+        };
+    }
+    const context = await loadHostCapabilityHookContext(root, state, payload, sessionKey);
+    if (!context) {
+        return {
+            decision: 'block',
+            permissionDecision: 'deny',
+            reason: 'SKS denied this acas-tools call because it has no valid task-scoped Naruto mission, run, and session context.'
+        };
+    }
+    if (!context.binding) {
+        return {
+            decision: 'block',
+            permissionDecision: 'deny',
+            reason: `SKS denied this acas-tools call because the current Naruto mission has no valid task-scoped host capability runtime: ${context.blocker}`
+        };
+    }
+    const observation = sanitizeHostCapabilityPreToolUse(context.binding.runtime, payload);
+    if (!observation) {
+        return {
+            decision: 'block',
+            permissionDecision: 'deny',
+            reason: 'SKS denied this acas-tools call because its official PreToolUse identity fields are invalid.'
+        };
+    }
+    let authorization = {
+        decision: observation.decision,
+        blocker: observation.blocker
+    };
+    try {
+        await withFileLock({
+            lockPath: path.join(context.dir, '.host-capability-hooks.lock'),
+            timeoutMs: 5_000,
+            staleMs: 60_000
+        }, async () => {
+            const current = await readJson(path.join(context.dir, HOST_CAPABILITY_HOOK_OBSERVATIONS_FILENAME), null).catch(() => null);
+            const result = authorizeAndMergeHostCapabilityPreToolObservation({
+                binding: context.binding,
+                current,
+                observation
+            });
+            authorization = result;
+            await writeJsonAtomic(path.join(context.dir, HOST_CAPABILITY_HOOK_OBSERVATIONS_FILENAME), result.observations);
+        });
+    }
+    catch {
+        return {
+            decision: 'block',
+            permissionDecision: 'deny',
+            reason: 'SKS denied this acas-tools call because its bounded PreToolUse evidence could not be persisted.'
+        };
+    }
+    if (authorization.decision === 'denied') {
+        return {
+            decision: 'block',
+            permissionDecision: 'deny',
+            reason: authorization.blocker
+                ? `SKS denied acas-tools.${observation.tool}; ${authorization.blocker}.`
+                : `SKS denied acas-tools.${observation.tool}; it is outside runtime.allowed_tool_names for this mission, run, and session.`
+        };
+    }
+    return { continue: true };
+}
+async function recordHostCapabilityPostTool(root, state = {}, payload = {}, sessionKey = null) {
+    if (!acasHostToolName(payload.tool_name))
+        return null;
+    const context = await loadHostCapabilityHookContext(root, state, payload, sessionKey);
+    if (!context?.binding)
+        return null;
+    const observation = sanitizeHostCapabilityPostToolUse(payload);
+    if (!observation)
+        return null;
+    return withFileLock({
+        lockPath: path.join(context.dir, '.host-capability-hooks.lock'),
+        timeoutMs: 5_000,
+        staleMs: 60_000
+    }, async () => {
+        const current = await readJson(path.join(context.dir, HOST_CAPABILITY_HOOK_OBSERVATIONS_FILENAME), null).catch(() => null);
+        const next = mergeHostCapabilityPostToolObservation({
+            binding: context.binding,
+            current,
+            observation
+        });
+        const evidence = buildHostCapabilityEvidenceFromHookObservations({
+            binding: context.binding,
+            observations: next
+        });
+        await Promise.all([
+            writeJsonAtomic(path.join(context.dir, HOST_CAPABILITY_HOOK_OBSERVATIONS_FILENAME), next),
+            writeJsonAtomic(path.join(context.dir, HOST_CAPABILITY_HOOK_EVIDENCE_FILENAME), evidence)
+        ]);
+        return evidence;
+    });
+}
+async function loadHostCapabilityHookContext(root, state = {}, payload = {}, sessionKey = null) {
+    const missionId = String(state?.mission_id || '').trim();
+    const workflowRunId = String(state?.official_subagent_run_id || '').trim();
+    const payloadSession = String(payload?.session_id || '').trim();
+    const expectedSession = String(state?.session_scope || sessionKey || '').trim();
+    const isNaruto = String(state?.mode || '').toUpperCase() === 'NARUTO'
+        || String(state?.route || state?.route_command || '').replace(/^\$/, '').toUpperCase() === 'NARUTO'
+        || state?.subagents_required === true;
+    if (!isNaruto || !missionId || !workflowRunId || !payloadSession || !expectedSession)
+        return null;
+    if (payloadSession !== expectedSession || (sessionKey && String(sessionKey) !== payloadSession))
+        return null;
+    const dir = missionDir(root, missionId);
+    const [raw, plan] = await Promise.all([
+        readJson(path.join(dir, HOST_CAPABILITY_HOOK_RUNTIME_FILENAME), null).catch(() => null),
+        readJson(path.join(dir, 'subagent-plan.json'), null).catch(() => null)
+    ]);
+    const request = requestHostCapabilities(plan?.goal || state?.prompt || '');
+    return { dir, ...resolveHostCapabilityHookRuntimeBinding(raw, {
+            missionId,
+            workflowRunId,
+            sessionScope: payloadSession,
+            request
+        }) };
+}
 function needsMutationSafetyCheck(payload = {}) {
     const toolName = String(payload.tool_name || payload.toolName || payload.name || payload.tool?.name || '');
     const knownReadOnly = /^(Read|Grep|Glob|LS|TodoRead|WebFetch|WebSearch|BashOutput|NotebookRead|ListMcpResources|ReadMcpResource)$/i;
@@ -874,290 +883,6 @@ async function hookStop(root, state, payload, noQuestion, sessionKey = null) {
         reason: 'SKS no-question run is not done. Continue autonomously, fix failing checks, update the active gate file, and do not ask the user.'
     };
 }
-export async function refreshOfficialSubagentCompletionArtifacts(root, state = {}, parentSummary = '', sessionKey = null) {
-    const id = state?.mission_id;
-    if (!id)
-        return null;
-    const dir = missionDir(root, id);
-    const snapshot = await withOfficialSubagentLifecycleLock(dir, () => refreshOfficialSubagentCompletionArtifactsLocked(root, state, parentSummary, sessionKey, dir));
-    if (snapshot?.terminal?.passed === true) {
-        await finalizeNarutoTerminalProof(root, state, sessionKey, dir, snapshot.terminal);
-    }
-    return snapshot?.evidence ?? snapshot;
-}
-async function refreshOfficialSubagentCompletionArtifactsLocked(root, state, parentSummary, sessionKey, dir) {
-    if (await officialSubagentPreparationInProgress(dir))
-        return null;
-    const id = state?.mission_id;
-    const plan = await readJson(path.join(dir, 'subagent-plan.json'), null).catch(() => null);
-    if (plan?.workflow !== 'official_codex_subagent')
-        return null;
-    const workflowRunId = String(plan.workflow_run_id || state.official_subagent_run_id || '').trim();
-    if (!workflowRunId || String(state.official_subagent_run_id || '').trim() !== workflowRunId)
-        return null;
-    const [existingGate, existingSummary, rawExistingEvidence, existingParentSummary] = await Promise.all([
-        readJson(path.join(dir, 'naruto-gate.json'), null).catch(() => null),
-        readJson(path.join(dir, 'naruto-summary.json'), null).catch(() => null),
-        readJson(path.join(dir, SUBAGENT_EVIDENCE_FILENAME), null).catch(() => null),
-        readJson(path.join(dir, SUBAGENT_PARENT_SUMMARY_FILENAME), null).catch(() => null)
-    ]);
-    const existingEvidence = normalizeLegacySubagentCountFields(rawExistingEvidence, plan);
-    if (completeNarutoTerminalBundle({
-        workflowRunId,
-        gate: existingGate,
-        summary: existingSummary,
-        evidence: existingEvidence,
-        parentSummary: existingParentSummary
-    })) {
-        return {
-            evidence: existingEvidence,
-            terminal: { passed: true, missionId: state.mission_id, workflowRunId, gate: existingGate }
-        };
-    }
-    const events = await readSubagentEvents(dir);
-    const lifecycle = await refreshSubagentWaveLifecycle(dir, { plan }).catch(() => plan.wave_lifecycle || null);
-    const refreshedPlan = lifecycle ? { ...plan, wave_lifecycle: lifecycle } : plan;
-    const countTarget = effectiveSubagentTarget(refreshedPlan, lifecycle?.cumulative_started || 0);
-    const requestedSubagents = countTarget.requestedSubagents || Number(state.requested_subagents || 0);
-    const runBoundParentSummary = bindTrustworthySubagentParentSummaryToRun(parentSummary, workflowRunId);
-    const effectiveParentSummary = await persistOrReuseTrustworthySubagentParentSummary(dir, runBoundParentSummary, {
-        workflowStatus: 'parent_completed',
-        runId: workflowRunId || null
-    });
-    const structuredParentSummary = normalizeSubagentParentSummary(effectiveParentSummary);
-    const evidence = await writeSubagentEvidence(dir, {
-        requestedSubagents,
-        countPolicy: countTarget.countPolicy,
-        targetSubagents: countTarget.targetSubagents,
-        events,
-        parentSummary: effectiveParentSummary,
-        workflowStatus: 'parent_completed',
-        preparationOnly: false,
-        runId: workflowRunId || null,
-        additionalBlockers: Array.isArray(plan.config_blockers)
-            ? [
-                ...plan.config_blockers.map((item) => `official_subagent_config:${String(item)}`),
-                ...subagentCountContractBlockers(refreshedPlan, lifecycle?.cumulative_started || 0)
-            ]
-            : subagentCountContractBlockers(refreshedPlan, lifecycle?.cumulative_started || 0)
-    });
-    if (structuredParentSummary.trustworthy) {
-        const parentTelemetry = await recordOfficialSubagentParentOutcomesTelemetry({
-            root,
-            routeMissionId: id,
-            parentSummary: structuredParentSummary.raw,
-            plan: refreshedPlan
-        }).catch(async (error) => {
-            await appendJsonl(path.join(dir, 'zellij-telemetry-warnings.jsonl'), {
-                ts: nowIso(),
-                warning: 'official_subagent_parent_outcome_telemetry_failed',
-                error: String(error?.message || error)
-            }).catch(() => null);
-            return null;
-        });
-        if (parentTelemetry?.blocker) {
-            await appendJsonl(path.join(dir, 'zellij-telemetry-warnings.jsonl'), {
-                ts: nowIso(),
-                warning: 'official_subagent_parent_outcome_telemetry_incomplete',
-                blocker: parentTelemetry.blocker,
-                failed_mission_ids: 'failed_mission_ids' in parentTelemetry ? parentTelemetry.failed_mission_ids : [],
-                skipped_thread_ids: 'skipped_thread_ids' in parentTelemetry ? parentTelemetry.skipped_thread_ids : []
-            }).catch(() => null);
-        }
-    }
-    const isNaruto = String(state?.mode || '').toUpperCase() === 'NARUTO'
-        || String(state?.route || state?.route_command || '').replace(/^\$/, '').toUpperCase() === 'NARUTO';
-    if (!isNaruto) {
-        await updateCurrentIfMissionAndRun(root, id, workflowRunId, {
-            subagents_spawned: evidence.started_threads > 0,
-            subagents_reported: evidence.completed_threads > 0,
-            subagents_verified: evidence.ok,
-            subagent_evidence_file: SUBAGENT_EVIDENCE_FILENAME,
-            parent_summary_present: evidence.parent_summary_present
-        }, { sessionKey: sessionKey || state._session_key });
-        return { evidence, terminal: null };
-    }
-    const previousGate = existingGate || {};
-    const parentModel = plan.observed_parent_model || state.observed_parent_model || null;
-    const parentModelMismatch = previousGate.parent_model_match === false || observedParentModelMismatch(parentModel, NARUTO_PARENT_MODEL);
-    const blockers = [...new Set([
-            ...evidence.blockers,
-            ...(Array.isArray(previousGate.config_blockers) ? previousGate.config_blockers.map(String) : []),
-            ...(Array.isArray(plan.config_blockers) ? plan.config_blockers.map((item) => `official_subagent_config:${String(item)}`) : []),
-            ...(parentModelMismatch ? [`parent_model_mismatch:${String(parentModel || 'unknown')}`] : [])
-        ])];
-    const ssotValidation = validateSsotGuardArtifact(await readJson(path.join(dir, SSOT_GUARD_ARTIFACT), null).catch(() => null));
-    blockers.push(...ssotValidation.issues.map((issue) => `${SSOT_GUARD_ARTIFACT}:${issue}`));
-    const uniqueBlockers = [...new Set(blockers)];
-    const passed = evidence.ok === true && ssotValidation.ok && uniqueBlockers.length === 0;
-    const updatedAt = nowIso();
-    const summary = {
-        schema: 'sks.naruto-subagent-workflow.v1',
-        ok: passed,
-        completion_evidence: passed,
-        workflow: 'official_codex_subagent',
-        workflow_run_id: workflowRunId || null,
-        mission_id: id,
-        route: '$Naruto',
-        status: passed ? 'completed' : evidence.status,
-        parent: {
-            model: NARUTO_PARENT_MODEL,
-            model_reasoning_effort: NARUTO_PARENT_EFFORT,
-            observed_model: parentModel,
-            observed_model_match: parentModel ? !parentModelMismatch : null
-        },
-        requested_subagents: requestedSubagents,
-        count_policy: evidence.count_policy,
-        target_subagents: evidence.target_subagents,
-        wave_lifecycle: lifecycle,
-        max_threads: Number(plan.max_threads || state.subagent_max_threads || 0),
-        max_depth: 1,
-        started_subagents: evidence.started_threads,
-        completed_subagents: evidence.completed_threads,
-        failed_subagents: evidence.failed_threads,
-        agents: officialSubagentRolePlan(),
-        verification: {
-            budget: plan.verification?.budget || plan.verification_budget || 'affected',
-            checks: Array.isArray(plan.verification?.checks)
-                ? plan.verification.checks
-                : Array.isArray(plan.verification_checks)
-                    ? plan.verification_checks
-                    : []
-        },
-        parent_summary_present: evidence.parent_summary_present,
-        parent_summary: structuredParentSummary.summary,
-        parent_thread_outcomes: structuredParentSummary.raw?.thread_outcomes || [],
-        subagent_evidence: SUBAGENT_EVIDENCE_FILENAME,
-        blockers: uniqueBlockers,
-        updated_at: updatedAt
-    };
-    await writeJsonAtomic(path.join(dir, 'naruto-summary.json'), summary);
-    const gate = await writeNarutoGate(dir, {
-        missionId: id,
-        workflowRunId,
-        evidence,
-        passed,
-        blockers: uniqueBlockers,
-        configBlockers: [
-            ...(Array.isArray(previousGate.config_blockers) ? previousGate.config_blockers.map(String) : []),
-            ...(Array.isArray(plan.config_blockers) ? plan.config_blockers.map((item) => `official_subagent_config:${String(item)}`) : [])
-        ],
-        observedParentModel: parentModel,
-        parentModelMatch: parentModel ? !parentModelMismatch : null
-    });
-    await updateCurrentIfMissionAndRun(root, id, workflowRunId, {
-        subagents_spawned: evidence.started_threads > 0,
-        subagents_reported: evidence.completed_threads > 0,
-        subagents_verified: evidence.ok,
-        subagent_evidence_file: SUBAGENT_EVIDENCE_FILENAME,
-        parent_summary_present: evidence.parent_summary_present
-    }, { sessionKey: sessionKey || state._session_key });
-    return {
-        evidence,
-        terminal: passed ? { passed: true, missionId: id, workflowRunId, gate } : null
-    };
-}
-function completeNarutoTerminalBundle(input) {
-    const runId = String(input.workflowRunId || '').trim();
-    const parent = normalizeSubagentParentSummary(input.parentSummary);
-    return Boolean(runId
-        && input.gate?.workflow_run_id === runId
-        && input.gate?.passed === true
-        && input.gate?.terminal === true
-        && input.summary?.workflow_run_id === runId
-        && input.summary?.ok === true
-        && input.summary?.status === 'completed'
-        && input.evidence?.run_id === runId
-        && input.evidence?.ok === true
-        && input.evidence?.status === 'completed'
-        && parent.trustworthy
-        && parent.status === 'completed'
-        && parent.run_id === runId);
-}
-async function finalizeNarutoTerminalProof(root, state, sessionKey, dir, terminal) {
-    // Lock order is finalization -> lifecycle -> session state. Preparation starts
-    // at lifecycle -> session state and never acquires the finalization lock.
-    await withFileLock({
-        lockPath: path.join(dir, '.naruto-finalize.lock'),
-        timeoutMs: 5_000,
-        staleMs: 30_000
-    }, () => withOfficialSubagentLifecycleLock(dir, async () => {
-        if (await officialSubagentPreparationInProgress(dir))
-            return;
-        const [currentPlan, currentGate] = await Promise.all([
-            readJson(path.join(dir, 'subagent-plan.json'), null).catch(() => null),
-            readJson(path.join(dir, 'naruto-gate.json'), null).catch(() => null)
-        ]);
-        if (String(currentPlan?.workflow_run_id || '').trim() !== terminal.workflowRunId
-            || String(currentGate?.workflow_run_id || '').trim() !== terminal.workflowRunId
-            || currentGate?.passed !== true
-            || currentGate?.terminal !== true)
-            return;
-        let proofStatus = await currentNarutoProofStatus(root, terminal.missionId, terminal.workflowRunId, state);
-        if (!proofStatus.valid) {
-            const finalized = await maybeFinalizeRoute(root, {
-                missionId: terminal.missionId,
-                route: '$Naruto',
-                gateFile: 'naruto-gate.json',
-                gate: currentGate,
-                artifacts: [
-                    'subagent-plan.json',
-                    'subagent-events.jsonl',
-                    SUBAGENT_PARENT_SUMMARY_FILENAME,
-                    SUBAGENT_EVIDENCE_FILENAME,
-                    'naruto-summary.json',
-                    'naruto-gate.json'
-                ],
-                claims: [{ id: 'naruto-official-subagent-completion', status: 'supported', evidence: 'naruto-gate.json' }],
-                agents: true
-            });
-            if (finalized?.ok !== true) {
-                throw new Error(`naruto_terminal_proof_finalize_failed:${String(finalized?.validation?.issues?.join(',') || finalized?.status || 'unknown')}`);
-            }
-            proofStatus = await currentNarutoProofStatus(root, terminal.missionId, terminal.workflowRunId, state);
-        }
-        if (!proofStatus.valid)
-            throw new Error('naruto_terminal_proof_invalid_after_finalize');
-        await closeWorkOrderLedgerForRouteResult(dir, { ok: true });
-        await invalidateReflectionForNarutoProofOnce(root, state, sessionKey, terminal.workflowRunId, proofStatus.digest);
-    }));
-}
-async function currentNarutoProofStatus(root, missionId, workflowRunId, state) {
-    const validation = await validateRouteCompletionProof(root, {
-        missionId,
-        route: '$Naruto',
-        state: {
-            ...state,
-            mission_id: missionId,
-            subagents_required: true,
-            official_subagent_run_id: workflowRunId
-        }
-    }).catch(() => null);
-    const proofRunId = String(validation?.proof?.evidence?.route_gate?.workflow_run_id || '').trim();
-    const proofText = await readText(path.join(root, '.sneakoscope', 'missions', missionId, 'completion-proof.json'), '').catch(() => '');
-    return {
-        valid: validation?.ok === true && proofRunId === workflowRunId,
-        proof: validation?.proof || null,
-        digest: proofText ? `sha256:${sha256(proofText)}` : null
-    };
-}
-async function invalidateReflectionForNarutoProofOnce(root, state, sessionKey, workflowRunId, proofDigest) {
-    if (!workflowRunId || !proofDigest)
-        return;
-    const resolvedSessionKey = sessionKey || state?._session_key;
-    await updateCurrentIfMissionAndRun(root, state?.mission_id, workflowRunId, (current) => {
-        if (current?.reflection_invalidated_for_workflow_run_id === workflowRunId
-            && current?.reflection_invalidated_for_proof_digest === proofDigest)
-            return null;
-        return {
-            reflection_invalidation_required: true,
-            reflection_invalidated_at: nowIso(),
-            reflection_invalidation_reason: 'naruto_terminal_proof_committed',
-            reflection_invalidated_for_workflow_run_id: workflowRunId,
-            reflection_invalidated_for_proof_digest: proofDigest
-        };
-    }, { sessionKey: resolvedSessionKey });
-}
 async function consumeLightRouteStop(root, payload = {}) {
     const file = path.join(root, '.sneakoscope', 'state', LIGHT_ROUTE_STOP_ARTIFACT);
     const record = await readJson(file, null).catch(() => null);
@@ -1280,14 +1005,19 @@ function shouldLoopBackAfterHonestMode(state = {}) {
     const route = String(state.route || state.mode || '').toLowerCase();
     if (['answer', 'dfix', 'wiki'].includes(route))
         return false;
+    const attempts = Number(state.honest_loop_attempt_count || 0);
+    if (Number.isFinite(attempts) && attempts >= MAX_HONEST_LOOPBACK_ATTEMPTS)
+        return false;
     return Boolean(state.ambiguity_gate_passed || state.clarification_passed || /CONTRACT_SEALED|HONEST_LOOPBACK/i.test(String(state.phase || '')));
 }
+const MAX_HONEST_LOOPBACK_ATTEMPTS = 2;
 async function recordHonestModeLoopback(root, state = {}, lastMessage = '', sessionKey = null) {
     const id = state.mission_id;
     const dir = missionDir(root, id);
     const previousPhase = state.phase || null;
     const mode = String(state.mode || state.route || 'SKS').toUpperCase();
     const phase = `${mode}_HONEST_LOOPBACK_AFTER_CLARIFICATION`;
+    const attempt = Number(state.honest_loop_attempt_count || 0) + 1;
     const artifact = {
         schema_version: 1,
         mission_id: id,
@@ -1295,16 +1025,21 @@ async function recordHonestModeLoopback(root, state = {}, lastMessage = '', sess
         phase,
         created_at: nowIso(),
         reason: 'honest_mode_unresolved_gap',
+        attempt,
+        max_attempts: MAX_HONEST_LOOPBACK_ATTEMPTS,
         issue_lines: honestModeGapLines(lastMessage),
-        next_action: 'continue_from_sealed_contract_without_reasking'
+        next_action: attempt >= MAX_HONEST_LOOPBACK_ATTEMPTS
+            ? 'stop_with_terminal_blocker_or_record_hard_blocker'
+            : 'continue_from_sealed_contract_without_reasking'
     };
     const file = path.join(dir, 'honest-loopback.json');
     await writeJsonAtomic(file, artifact);
-    await appendJsonl(path.join(dir, 'events.jsonl'), { ts: nowIso(), type: 'pipeline.honest_mode.loopback', previous_phase: previousPhase, phase, issues: artifact.issue_lines });
+    await appendJsonl(path.join(dir, 'events.jsonl'), { ts: nowIso(), type: 'pipeline.honest_mode.loopback', previous_phase: previousPhase, phase, attempt, issues: artifact.issue_lines });
     await setCurrent(root, {
         phase,
         honest_loop_required: true,
         honest_loop_detected_at: artifact.created_at,
+        honest_loop_attempt_count: attempt,
         implementation_allowed: true,
         clarification_required: false,
         questions_allowed: false,