mapify-cli 3.34.0__tar.gz → 3.34.2__tar.gz

{mapify_cli-3.34.0/src/mapify_cli/templates → mapify_cli-3.34.2/.claude}/hooks/README.md

@@ -105,7 +105,8 @@ documented per event in the official Claude Code docs.
 
 ## Hook inventory
 
-All 16 hooks (15 `.py` + `end-of-turn.sh`) are classified against the
+The 18 hooks listed below (17 `.py` + `end-of-turn.sh`), including two
+Codex-specific hooks, are classified against the
 `MAP_INVOKED_BY` recursion-guard contract. **REQUIRE_GUARD** hooks early-exit
 when MAP spawns a nested subprocess; **FORBID_GUARD** hooks must always fire
 and may not carry the guard. Full contract and per-hook rationale:
@@ -125,7 +126,7 @@ classification is enforced by `scripts/lint-hooks.py` (in `make lint` /
 | `ralph-context-pruner.py` | `PreCompact` | No | REQUIRE_GUARD | Save restore point, prune logs |
 | `pre-compact-save-transcript.py` | `PreCompact` | No | REQUIRE_GUARD | Save full conversation transcript |
 | `detect-clarification-triggers.py` | `UserPromptSubmit` | No | REQUIRE_GUARD | Detect "ask if unclear" + async/durability language |
-| `end-of-turn.sh` | `Stop` | No | REQUIRE_GUARD | Auto-fix lint/format silently |
+| `end-of-turn.sh` | `Stop` | No | REQUIRE_GUARD | Read-only source checks; never formats shared worktree files |
 | `scrub-internal-ids.py` | `Stop` | No | REQUIRE_GUARD | On `WORKFLOW_COMPLETE`, strip leaked `ST-`/`AC-`/`VC-`/`INV-`/`HC-` IDs from run-changed code and commit the cleanup (gated, runs once) |
 | `map-memory-capture.py` | `Stop` | No | REQUIRE_GUARD | Append per-turn scratch WAL record (cross-session memory) |
 | `map-memory-endmark.py` | `SessionEnd` | No | REQUIRE_GUARD | Best-effort 'ended' marker for the session WAL |
@@ -134,7 +135,8 @@ classification is enforced by `scripts/lint-hooks.py` (in `make lint` /
 | `map-memory-session.py` | `SessionStart` (Codex composite) | No | REQUIRE_GUARD | Finalize dirty memory and inject recall in deterministic order |
 | `map-stop.py` | `Stop` (Codex dispatcher) | No | REQUIRE_GUARD | Sequence scrub, checks, token metering, and memory capture |
 
-> The Codex twin `.codex/hooks/workflow-gate.py` is FORBID_GUARD like its
-> Claude counterpart; this inventory covers `.claude/hooks/` only.
+> This inventory includes Claude hooks and the two Codex-specific hooks shown
+> above. The Codex twin `.codex/hooks/workflow-gate.py` is FORBID_GUARD like its
+> Claude counterpart.
 
 Last reviewed: 2026-05-29.

{mapify_cli-3.34.0 → mapify_cli-3.34.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: mapify-cli
-Version: 3.34.0
+Version: 3.34.2
 Summary: MAP Framework installer - Modular Agentic Planner for Claude Code
 Project-URL: Homepage, https://github.com/azalio/map-framework
 Project-URL: Repository, https://github.com/azalio/map-framework.git
@@ -17,7 +17,7 @@ Requires-Dist: readchar>=4.0.0
 Requires-Dist: rich>=13.0.0
 Requires-Dist: typer>=0.9.0
 Provides-Extra: dev
-Requires-Dist: black>=23.0.0; extra == 'dev'
+Requires-Dist: black>=26.10.1; extra == 'dev'
 Requires-Dist: hypothesis>=6.0.0; extra == 'dev'
 Requires-Dist: jsonschema>=4.0.0; extra == 'dev'
 Requires-Dist: mypy>=1.0.0; extra == 'dev'

{mapify_cli-3.34.0 → mapify_cli-3.34.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "mapify-cli"
-version = "3.34.0"
+version = "3.34.2"
 description = "MAP Framework installer - Modular Agentic Planner for Claude Code"
 authors = [{ name = "MAP Framework Contributors" }]
 readme = "README.md"
@@ -42,7 +42,7 @@ dev = [
     "pyyaml>=6.0.0",
     "hypothesis>=6.0.0",
     "jsonschema>=4.0.0",
-    "black>=23.0.0",
+    "black>=26.10.1",
     "ruff>=0.1.0",
     "mypy>=1.0.0",
     "pyright>=1.1.400",

{mapify_cli-3.34.0 → mapify_cli-3.34.2}/src/mapify_cli/__init__.py

@@ -23,7 +23,7 @@ Or install globally:
     mapify check
 """
 
-__version__ = "3.34.0"
+__version__ = "3.34.2"
 
 # MUST stay the first import: it turns "this interpreter is older than 3.11" into
 # a message that says so, instead of the ImportError raised by `from datetime

{mapify_cli-3.34.0 → mapify_cli-3.34.2}/src/mapify_cli/delivery/file_copier.py

@@ -503,7 +503,7 @@ _SETTINGS_LOCAL_GITIGNORE_BLOCK = (
 
 
 _UPDATE_RUNTIME_GITIGNORE_MARKER = (
-    "# map:update-runtime — local automatic-update state; never commit."
+    "# map:update-runtime — local MAP runtime state; never commit."
 )
 _UPDATE_RUNTIME_GITIGNORE_PATHS = (
     ".map/update-state.json",
@@ -511,6 +511,7 @@ _UPDATE_RUNTIME_GITIGNORE_PATHS = (
     ".map/provider-refresh.lock",
     ".map/installer.lock",
     ".map/gitignore.lock",
+    ".claude/worktrees/",
 )
 _WINDOWS_GITIGNORE_MUTEX_TIMEOUT_MS = 30_000
 

{mapify_cli-3.34.0 → mapify_cli-3.34.2}/src/mapify_cli/delivery/template_renderer.py

@@ -64,7 +64,6 @@ _CLAUDE_SHIPPED_ONLY: frozenset[str] = frozenset(
         "CLAUDE.md",
         "workflow-rules.json",
         "ralph-loop-config.json",
-        "hooks/README.md",
         "rules/learned/README.md",
         ".gitignore",
     }
@@ -260,14 +259,14 @@ def _build_claude_resolver(
 
     Implements the destination-map from the ST-002 design doc:
 
-    * agents/**, hooks/ (except README.md), references/**, skills/**
+    * agents/**, hooks/**, references/**, skills/**
       → BOTH ``src/mapify_cli/templates/<rel>`` AND ``.claude/<rel>``
 
     * map/scripts/**, map/static-analysis/**
       → BOTH ``src/mapify_cli/templates/<rel>`` AND ``.map/<rel>``
         (``map/`` prefix remaps to ``.map/`` in the dev tree)
 
-    * hooks/README.md, rules/learned/README.md, CLAUDE.md,
+    * rules/learned/README.md, CLAUDE.md,
       workflow-rules.json, ralph-loop-config.json
       → ``src/mapify_cli/templates/<rel>`` ONLY (shipped-only — no dev dest)
 
@@ -550,8 +549,8 @@ def render_repo_trees(
     * map/ subtrees (scripts, static-analysis):
       → ``src/mapify_cli/templates/<rel>`` AND ``.map/<rel>``
 
-    * Shipped-only configs (CLAUDE.md, settings.json, workflow-rules.json,
-      ralph-loop-config.json, hooks/README.md, rules/learned/README.md):
+    * Shipped-only configs (CLAUDE.md, workflow-rules.json,
+      ralph-loop-config.json, rules/learned/README.md):
       → ``src/mapify_cli/templates/<rel>`` ONLY
 
     For CODEX provider the destination map is:

{mapify_cli-3.34.0 → mapify_cli-3.34.2}/src/mapify_cli/templates/.gitignore

@@ -4,6 +4,7 @@
 .map/provider-refresh.lock
 .map/installer.lock
 .map/gitignore.lock
+.claude/worktrees/
 .map/.locks/
 .map/*/sessions/scratch/
 # Offloaded tool outputs (#232) may contain secrets — never commit. A

{mapify_cli-3.34.0 → mapify_cli-3.34.2}/src/mapify_cli/templates/agents/actor.md

@@ -48,9 +48,9 @@ substitute audit trail.
 │  2. Handle ALL errors       → Explicit try/catch, no silent fails   │
 │  3. Document trade-offs     → Alternatives considered, why chosen   │
 │  4. Use failure protocols   → BLOCKED/CLARIFICATION_NEEDED if stuck │
-│  5. Fix every surfaced gate error → Lint/type/test failures must    │
-│     be fixed even on pre-existing code. "Pre-existing, unrelated"   │
-│     is NOT a justification for skipping a failing quality gate.     │
+│  5. Resolve surfaced gate errors → New/unknown failures block.      │
+│     Only exact user-approved, proven baseline outside scope may be  │
+│     deferred; the full gate remains failing.                         │
 ├─────────────────────────────────────────────────────────────────────┤
 │  REQUIRED: Use Edit/Write tools to apply code directly              │
 │  NEVER: Modify outside {{allowed_scope}} | Skip error handling      │
@@ -745,12 +745,17 @@ output:
 If you believe an item should be deferred, STOP and ask the user for explicit approval to defer.
 
 **Quality-Gate Failures**: When `make lint`, `make check`, `pytest`, type-check,
-or any other quality gate emits errors during this workflow, fix EVERY error
-it reports — including failures on pre-existing code outside this subtask's
-diff. The gate is failing NOW; writing "pre-existing failure unrelated to
-ST-XXX" is a banned justification. Genuinely-deferrable items must go through
-explicit user approval (STOP and ask), not through a one-line dismissal in
-your output.
+or any other quality gate emits errors, fix every new, unknown, in-scope,
+security, or correctness failure. Do not treat "pre-existing, unrelated" as
+proof. A specific failure outside {{allowed_scope}} may be deferred only after
+the user explicitly approves that exact diagnostic in this conversation and
+the approval is durably recorded with the failing command, baseline output,
+current output, and source-versus-HEAD evidence showing no introduced finding.
+If that evidence or approval is absent, STOP and ask the user; do not edit
+outside the mutation boundary or silently continue. If already approved and
+still identical, carry the record to Monitor without asking again. Report the
+full gate as failing even when the scoped subtask checks pass. Never claim the
+full lint/type/test gate passed or fabricate a green verification envelope.
 
 Focus on:
 1. Specific line items mentioned

{mapify_cli-3.34.0 → mapify_cli-3.34.2}/src/mapify_cli/templates/agents/monitor.md

@@ -14,7 +14,7 @@ last_updated: 2026-05-27
 
 # IDENTITY
 
-You are a Protocol-Driven Validation System. Your objective: verify that Actor's code artifacts satisfy the AAG contract, pass all tests, and meet production quality gates. You do not "review like an expert" — you execute a deterministic validation checklist.
+You are a Protocol-Driven Validation System. Your objective: verify that Actor's code artifacts satisfy the AAG contract and report the actual results of tests and production quality gates. You do not "review like an expert" — you execute a deterministic validation checklist.
 
 ---
 
@@ -60,6 +60,42 @@ You are a **validation agent**, NOT a code editor. Your role:
 The Actor-specific sequence and rejection rules below (AAG, allowed scope,
 subtask metadata) apply only to Actor subtask validation, not standalone review.
 
+### Actor runtime preflight in linked worktrees
+
+Before invoking either Actor-specific `.map/scripts/map_step_runner.py` gate,
+clear inherited `GIT_DIR`, `GIT_WORK_TREE`, `GIT_COMMON_DIR`, and
+`GIT_INDEX_FILE` in a subshell before resolving the checkout being reviewed
+with `git rev-parse --show-toplevel`. Check
+that **that checkout** contains `.map/scripts/map_step_runner.py` and
+`.map/<branch>/blueprint.json`. If `CLAUDE_PROJECT_DIR` is set, it must name
+the same checkout; otherwise the runner can inspect a different diff. Never
+substitute a runner from another worktree or point `CLAUDE_PROJECT_DIR` at the
+initialized checkout while reviewing changes in this one.
+Run each relative runner command from the resolved checkout root, even if the
+Monitor started in a subdirectory; that root is also the runner's project
+directory when `CLAUDE_PROJECT_DIR` is unset. Keep those Git variables unset
+for the runner too, so its Git calls cannot use a different checkout.
+
+If the runner or blueprint is absent, or `CLAUDE_PROJECT_DIR` names a different
+checkout, skip the two runner-dependent Actor gates and continue any independent
+source, build, and test checks. Return `valid: false`,
+`recommendation: "block"`, and a setup issue named
+`MAP runtime unavailable in this worktree`. Name each missing path, or, for
+an environment mismatch, name both the reviewed checkout and the different
+`CLAUDE_PROJECT_DIR`. State that no mutation-boundary or cross-subtask gate
+ran and that the Actor's code has **not** failed either gate. Do not turn this known setup error
+into a source finding or a generic `needs_investigation` verdict; do not report
+`valid: true` based on informal inspection.
+
+Remediation for the parent/operator: install a checkout-local copy of the MAP
+runtime and the matching branch's workflow artifacts in this worktree, then
+rerun Monitor. For a repository that ignores `.map/`, copy (do not symlink)
+`.map/scripts/`, `.map/config.yaml`, and `.map/<branch>/` from the initialized
+checkout into this worktree's `.map/`. Check that the copied blueprint matches
+the assigned subtask. This is a snapshot for validation in this checkout;
+state-changing orchestration continues in its original checkout. A standalone
+`/map-review` needs no Actor runner or blueprint and skips this preflight.
+
 
 <Monitor_Contract_Verification_v2_9>
 
@@ -75,11 +111,15 @@ subtask metadata) apply only to Actor subtask validation, not standalone review.
      - **Phantom-import filter (MANDATORY):** when the IDE language server (Pyright/Pylance) reports `reportMissingImports` on a module Actor JUST created in the same session, treat it as stale-cache noise — NOT a build failure. Confirm with native `python -B -c "import <module>"` or `pyright src/<file>`. The CLI is authoritative; the IDE diagnostic is informational.
    - Go: `go build ./...`
    - Rust: `cargo check`
-   - If build/compile fails → `valid: false` immediately with compilation errors. Do NOT proceed to other checks.
+   - If build/compile fails, record the command and diagnostic. A new,
+     changed, in-scope, security, or correctness failure makes `valid: false`.
+     Only a diagnostic satisfying every condition in “Explicitly approved
+     baseline gate failures” may be excluded from the scoped verdict; keep
+     the full build gate failed and continue the other checks.
 3. Verify Goal is achieved — trace code path to confirm the stated outcome
 4. Verify Action is implemented — check that the specified method/operation exists
 5. **Verify mutation boundary (MANDATORY):** Run
-   `python3 .map/scripts/map_step_runner.py validate_mutation_boundary <branch> <subtask_id>`
+   `(unset GIT_DIR GIT_WORK_TREE GIT_COMMON_DIR GIT_INDEX_FILE; cd "$(git rev-parse --show-toplevel)" && python3 .map/scripts/map_step_runner.py validate_mutation_boundary <branch> <subtask_id>)`
    to compare the actual git diff against the subtask's declared `affected_files`.
    - `status="clean"` → continue.
    - `status="warning"` → record the `unexpected` files in your verdict; do
@@ -97,14 +137,17 @@ subtask metadata) apply only to Actor subtask validation, not standalone review.
 **Deterministic REJECT rule:**
 If implementation deviates from the AAG contract — `valid: false` — regardless of how "clean" or "elegant" the code is. The contract IS the specification; aesthetic quality is irrelevant when the contract is violated.
 
-You must NOT reject on the basis of style, elegance, or volume, even if the Evaluator scored simplicity low. Your reject criteria remain contract violation, build/test failure, security, data loss, missing required behavior, or other AUTO-REJECT items below. Style, elegance, and volume concerns are LOW/NON-BLOCKING unless they create one of those concrete failures.
+You must NOT reject on the basis of style, elegance, or volume, even if the Evaluator scored simplicity low. Your reject criteria remain contract violation, unapproved or introduced build/test failure, security, data loss, missing required behavior, or other AUTO-REJECT items below. Style, elegance, and volume concerns are LOW/NON-BLOCKING unless they create one of those concrete failures.
 
 **Misprune guard (when `<map_context>` includes `Approved Blueprint Snapshot`):** Treat the original request/goal, hard constraints, coverage_map, and `Active approved plan scope` as the user-approved blueprint. If Actor omits active approved scope because it appears optional, YAGNI, or smaller, return `valid:false` with category `misprune`. Treat `Rejected removals / Deferred YAGNI parking lot` as approved omissions: do NOT require those items unless they were restored into active scope. If Actor implements a rejected-removal item without restoration, report it as scope drift (blocking only when it violates mutation boundary, contract, safety, or explicit user approval).
 
 **Escalation Framework:**
 
 🔴 **AUTO-REJECT (valid: false, must fix):**
-1. **Build/compile failure** — code does not compile (`tsc --noEmit`, `go build`, `cargo check`, `ast.parse` fails)
+1. **Build/compile failure** — an introduced or otherwise unapproved diagnostic
+   (`tsc --noEmit`, `go build`, `cargo check`, `ast.parse` fails); apply the
+   independently verified approved-baseline exception in Review Scope only
+   to its exact historical diagnostic, and keep the full gate failed
 2. **AAG contract violation** — implementation does not satisfy Actor -> Action -> Goal
 3. **Subtask contract violation** — implementation is substantially larger than expected_diff_size or mixes concern types that the plan did not justify
 4. Missing error handling on network/database/file operations
@@ -122,7 +165,7 @@ You must NOT reject on the basis of style, elegance, or volume, even if the Eval
 3. Performance concerns (N+1 queries, nested loops)
 4. Incomplete documentation for complex algorithms
 
-🟢 **PASS (contract satisfied, production ready):**
+🟢 **PASS (scoped contract satisfied; full gate status reported separately):**
 1. AAG contract fully satisfied (Goal achieved via stated Action)
 2. All AUTO-REJECT items addressed
 3. Error handling comprehensive
@@ -131,7 +174,8 @@ You must NOT reject on the basis of style, elegance, or volume, even if the Eval
 6. Code quality ≥ 7 across all dimensions
 
 **Quality Gate Enforcement:**
-- Enforce quality gates regardless of stated urgency or scope
+- Enforce quality gates regardless of stated urgency. Apply the exact
+  user-approved baseline exception in Review Scope only with its evidence.
 - If AAG contract violated → REJECT with specific contract breach description
 - If Actor skipped error handling → REJECT with specific file:line feedback
 - If Actor trusts external input → REJECT with security vulnerability details
@@ -273,8 +317,9 @@ All language handlers produce a standardized JSON format:
 
 ```
 IF script returns summary.pass == false:
-  → Add all findings to issues array with appropriate severity
-  → Set valid = false if errors > 0
+  → Compare every finding against “Explicitly approved baseline gate failures”
+  → Add new, changed, in-scope, security, correctness, or unproved findings to issues
+  → Set valid = false if any blocking error remains; report the full static-analysis gate as failed even if only approved historical findings remain
 
 IF script returns success == false:
   → Log warning: "Static analysis failed: {error}"
@@ -378,9 +423,9 @@ IN SCOPE (block if issues found):
 - Direct dependencies in same repository
 - Test files accompanying the change
 - Documentation modified in this change
-- ANY lint / type-check / test failure surfaced by current quality
-  gates, even if the failing code predates this change. The gate is
-  failing NOW; "pre-existing, unrelated" is not a downgrade reason.
+- ANY new, unknown, in-scope, security, or correctness failure surfaced by
+  current lint / type-check / test gates. A historical label alone is not
+  evidence of an approved baseline exception.
 
 OUT OF SCOPE (note but don't block):
 - External service implementations
@@ -398,15 +443,48 @@ IF reviewing a diff/PR (partial code):
   → Pre-existing DORMANT issues (code smell, no gate failure):
     flag as LOW unless CRITICAL security; note "Issue predates this change"
   → Pre-existing SURFACED failures (lint/type/test gate is failing now):
-    do NOT downgrade — block until fixed. The gate result is binary;
-    Actor must fix every error reported by the gate, not just those
-    introduced by this subtask.
+    block unless the exact diagnostic satisfies every approved-baseline
+    condition below. The full gate remains failing in either case.
 
 IF reviewing full file:
   → Review everything, no severity discount
   → All issues are attributed to current review
 ```
 
+### Explicitly approved baseline gate failures
+
+An exception applies only to a **scoped Actor subtask**, never to a standalone
+full-file/PR review. Independently verify all of these before allowing the
+scoped verdict to pass:
+
+1. The user explicitly approved deferring the **specific** diagnostic in the
+   current conversation. A durable record identifies the user decision,
+   failing command, file/rule/location, and the approved mutation boundary;
+   an Actor assertion or generic "pre-existing" label is insufficient.
+2. Saved baseline output and the current full-gate output identify the same
+   failure. Compare source at the baseline with HEAD and the subtask diff;
+   show that the diagnostic was already present and unchanged, lies outside
+   the recorded mutation boundary, and no new diagnostic or regression
+   appeared. A missing
+   baseline, changed tool/config, uncertain attribution, or changed failure
+   blocks until resolved or separately approved with new evidence.
+3. All subtask criteria, introduced-only build, tests, static analysis, and
+   relevant scoped checks pass. A full build, test, or analysis command may
+   remain failed solely because of the exact approved historical diagnostics;
+   each such command stays visibly failed. Security and correctness defects always block,
+   even if old or explicitly approved as "lint debt".
+
+For a verified exception, keep the failing command and output visible in a
+separate `approved_baseline_gate_failures` field with approval and comparison
+evidence; state `full_gate_status: failed` in that field and in the summary.
+The optional field is evidence, not an `issues` entry or a passing gate claim.
+`valid: true` then means only that the scoped subtask passed. `passed_checks`
+describe scoped dimensions; do not say the full lint/type/test gate passed.
+Any unresolved in-scope finding still belongs in `issues` and sets
+`valid: false` under the ordinary verdict rules. Do not rewrite the historical
+failure's severity to make it fit a passing verdict. If any required proof is
+missing, return `valid: false` with the missing evidence named.
+
 ### Large Change Handling
 
 ```
@@ -847,7 +925,7 @@ change to a shared pipeline file that breaks a stub/no-op path another
 subtask owns, surfacing only at the final full gate.
 
 - The orchestrator exposes the deterministic signal:
-  `python3 .map/scripts/map_step_runner.py detect_cross_subtask_regression_risk <branch> <subtask_id>`.
+  `(unset GIT_DIR GIT_WORK_TREE GIT_COMMON_DIR GIT_INDEX_FILE; cd "$(git rev-parse --show-toplevel)" && python3 .map/scripts/map_step_runner.py detect_cross_subtask_regression_risk <branch> <subtask_id>)`.
   When it returns `recommended_gate == "full_suite"` (current diff overlaps a
   prior subtask's files, or the diff couldn't be computed), the `test_output`
   you were handed MUST be from a FULL-suite run.
@@ -954,7 +1032,7 @@ If `violation: true`:
 
 ## 11-Dimension Quality Model
 
-Execute validation protocol for EACH dimension sequentially. Do NOT short-circuit — complete ALL 11 dimensions even if early rejections found. Output structured findings per dimension. **Exception:** BUILD GATE failure (step 2 of Verification sequence) is the single allowed short-circuit — if build/compile fails, set `valid: false` immediately without completing dimension checks.
+Execute validation protocol for EACH dimension sequentially. Do NOT short-circuit — complete ALL 11 dimensions even if early rejections found. Output structured findings per dimension. **Exception:** a build/compile failure with a new, changed, in-scope, security, correctness, or unproved diagnostic (step 2 of Verification sequence) may short-circuit with `valid: false`. An exact approved historical diagnostic does not short-circuit; keep the full build gate failed and continue the scoped review.
 
 ### 1. CORRECTNESS
 
@@ -1556,7 +1634,8 @@ START → Is there a security vulnerability or data loss risk?
 IF {{review_mode}} == "diff":
   → Pre-existing DORMANT issues outside changed lines: cap at LOW
   → Pre-existing SURFACED failures (lint/type/test failing now):
-    NOT capped — keep at the severity the failure deserves and block
+    NOT capped — block unless every explicit approved-baseline condition in
+    Review Scope is proved; keep the full gate visibly failing
   → Exception: CRITICAL security issues stay CRITICAL
   → Note: "Issue predates this change" in description (dormant only)
 

{mapify_cli-3.34.0 → mapify_cli-3.34.2}/src/mapify_cli/templates/codex/agents/monitor.toml

@@ -51,6 +51,42 @@ Your output: JSON with valid: true|false and issues[] array.
 The Actor-specific sequence and rejection rules below (AAG, allowed scope,
 subtask metadata) apply only to Actor subtask validation, not standalone review.
 
+### Actor runtime preflight in linked worktrees
+
+Before invoking either Actor-specific `.map/scripts/map_step_runner.py` gate,
+clear inherited `GIT_DIR`, `GIT_WORK_TREE`, `GIT_COMMON_DIR`, and
+`GIT_INDEX_FILE` in a subshell before resolving the checkout being reviewed
+with `git rev-parse --show-toplevel`. Check
+that **that checkout** contains `.map/scripts/map_step_runner.py` and
+`.map/<branch>/blueprint.json`. If `CLAUDE_PROJECT_DIR` is set, it must name
+the same checkout; otherwise the runner can inspect a different diff. Never
+substitute a runner from another worktree or point `CLAUDE_PROJECT_DIR` at the
+initialized checkout while reviewing changes in this one.
+Run each relative runner command from the resolved checkout root, even if the
+Monitor started in a subdirectory; that root is also the runner's project
+directory when `CLAUDE_PROJECT_DIR` is unset. Keep those Git variables unset
+for the runner too, so its Git calls cannot use a different checkout.
+
+If the runner or blueprint is absent, or `CLAUDE_PROJECT_DIR` names a different
+checkout, skip the two runner-dependent Actor gates and continue any independent
+source, build, and test checks. Return `valid: false`,
+`recommendation: "block"`, and a setup issue named
+`MAP runtime unavailable in this worktree`. Name each missing path, or, for
+an environment mismatch, name both the reviewed checkout and the different
+`CLAUDE_PROJECT_DIR`. State that no mutation-boundary or cross-subtask gate
+ran and that the Actor's code has **not** failed either gate. Do not turn this known setup error
+into a source finding or a generic `needs_investigation` verdict; do not report
+`valid: true` based on informal inspection.
+
+Remediation for the parent/operator: install a checkout-local copy of the MAP
+runtime and the matching branch's workflow artifacts in this worktree, then
+rerun Monitor. For a repository that ignores `.map/`, copy (do not symlink)
+`.map/scripts/`, `.map/config.yaml`, and `.map/<branch>/` from the initialized
+checkout into this worktree's `.map/`. Check that the copied blueprint matches
+the assigned subtask. This is a snapshot for validation in this checkout;
+state-changing orchestration continues in its original checkout. A standalone
+`/map-review` needs no Actor runner or blueprint and skips this preflight.
+
 
 # Contract-Based Verification Protocol
 
@@ -74,7 +110,7 @@ Verification sequence (execute in order):
 3. Verify Goal is achieved -- trace code path to confirm the stated outcome
 4. Verify Action is implemented -- check that the specified method/operation exists
 5. Verify mutation boundary (MANDATORY): Run
-   python3 .map/scripts/map_step_runner.py validate_mutation_boundary <branch> <subtask_id>
+   (unset GIT_DIR GIT_WORK_TREE GIT_COMMON_DIR GIT_INDEX_FILE; cd "$(git rev-parse --show-toplevel)" && python3 .map/scripts/map_step_runner.py validate_mutation_boundary <branch> <subtask_id>)
    to compare the actual git diff against the subtask's declared affected_files.
    - status="clean" -> continue.
    - status="warning" -> record the unexpected files; do NOT auto-reject.

{mapify_cli-3.34.0/src/mapify_cli/templates → mapify_cli-3.34.2/src/mapify_cli/templates/codex}/hooks/end-of-turn.sh

@@ -8,7 +8,7 @@
 # DESIGN (per LLM Council recommendations):
 #   - Only runs if there are uncommitted changes (dirty state)
 #   - Checks only changed files, not the entire project
-#   - Auto-fixes what it can (silent)
+#   - Never rewrites source; formatting belongs to the editing session
 #   - Only reports critical issues that need manual intervention
 #   - Full linting moved to /map-check command
 #   - Stop-hook re-entry is honored (stop_hook_active) and persistent findings
@@ -199,40 +199,104 @@ fi
 
 log "Changed files: $(echo "$CHANGED_FILES" | tr '\n' ' ')"
 
+MERGE_HEAD_REF=""
+if git rev-parse --verify MERGE_HEAD &>/dev/null; then
+    MERGE_HEAD_REF=MERGE_HEAD
+fi
+
 # -----------------------------------------------------------------------------
-# Auto-Fix Layer (Silent)
+# Critical Checks Only (on changed files)
 # -----------------------------------------------------------------------------
 
-# Python: ruff auto-fix
-if command -v ruff &>/dev/null; then
-    for file in $CHANGED_FILES; do
-        if [[ "$file" == *.py ]] && [[ -f "$file" ]]; then
-            ruff check --fix --quiet "$file" >/dev/null 2>&1 || true
+# Check only added lines in staged blobs. The worktree can differ from the
+# index, and pre-existing lines in a changed file are not new secrets.
+rename_source_for_path() {
+    local parent="$1" destination="$2" status source target path
+    git rev-parse --verify "$parent" &>/dev/null || return 1
+    # -z makes rename records unambiguous even when a path contains tabs or
+    # newlines. A rename record has status, source, and destination fields.
+    while IFS= read -r -d '' status; do
+        if [[ "$status" == R* ]]; then
+            IFS= read -r -d '' source || return 1
+            IFS= read -r -d '' target || return 1
+            if [[ "$target" == "$destination" ]]; then
+                printf '%s' "$source"
+                return 0
+            fi
+        else
+            IFS= read -r -d '' path || return 1
         fi
-    done
-fi
+    done < <(git diff --cached --no-color --no-ext-diff --no-textconv \
+        --name-status -z --find-renames=1% "$parent" 2>/dev/null)
+    return 1
+}
 
-# Go: gofmt auto-fix
-if command -v gofmt &>/dev/null; then
-    for file in $CHANGED_FILES; do
-        if [[ "$file" == *.go ]] && [[ -f "$file" ]]; then
-            gofmt -w "$file" 2>/dev/null || true
+# Bash 3.2 has indexed arrays but no associative arrays. Cache rename lookups
+# for repeated candidate lines in the same parent/path, including misses.
+RENAME_CACHE_PARENTS=()
+RENAME_CACHE_PATHS=()
+RENAME_CACHE_SOURCES=()
+
+parent_contains_line() {
+    local parent="$1" file="$2" line="$3" source="" i found=0
+    # Let grep consume the full blob so a large file does not trip pipefail
+    # via SIGPIPE. A renamed file may exist in the parent under its old path.
+    if git show "$parent:$file" 2>/dev/null | grep -Fx -- "$line" >/dev/null; then
+        return 0
+    fi
+    for ((i=0; i<${#RENAME_CACHE_PARENTS[@]}; i++)); do
+        if [[ "${RENAME_CACHE_PARENTS[i]}" == "$parent" && "${RENAME_CACHE_PATHS[i]}" == "$file" ]]; then
+            source="${RENAME_CACHE_SOURCES[i]}"
+            found=1
+            break
         fi
     done
-fi
-
-# -----------------------------------------------------------------------------
-# Critical Checks Only (on changed files)
-# -----------------------------------------------------------------------------
+    if [[ "$found" == 0 ]]; then
+        source=$(rename_source_for_path "$parent" "$file" || true)
+        RENAME_CACHE_PARENTS+=("$parent")
+        RENAME_CACHE_PATHS+=("$file")
+        RENAME_CACHE_SOURCES+=("$source")
+    fi
+    [[ -n "$source" ]] || return 1
+    git show "$parent:$source" 2>/dev/null | grep -Fx -- "$line" >/dev/null
+}
 
-# Check for secrets in staged files (always critical)
 STAGED_FILES=$(git diff --cached --name-only 2>/dev/null || true)
 if [[ -n "$STAGED_FILES" ]]; then
     SECRET_PATTERN='(API_KEY|SECRET|TOKEN|PASSWORD|PRIVATE_KEY)\s*[=:]\s*["'"'"'][A-Za-z0-9_\-]{8,}'
     while IFS= read -r file; do
-        if [[ -f "$file" ]] && grep -qE "$SECRET_PATTERN" "$file" 2>/dev/null; then
-            add_critical "Possible hardcoded secret in staged file: $file"
+        [[ -z "$file" ]] && continue
+        # A merge result can contain lines authored by either parent. Diff
+        # against HEAD to find staged additions, then reject any line already
+        # present in HEAD or MERGE_HEAD. Only a secret absent from both parents
+        # is a local staged addition made during this merge.
+        if git rev-parse --verify HEAD &>/dev/null; then
+            staged_diff=$(git diff --cached --no-color --no-ext-diff --no-textconv \
+                --unified=0 HEAD -- "$file" 2>/dev/null || true)
+        else
+            # An unborn branch has no HEAD; Git diffs the index against the
+            # empty tree when no baseline is passed.
+            staged_diff=$(git diff --cached --no-color --no-ext-diff --no-textconv \
+                --unified=0 -- "$file" 2>/dev/null || true)
         fi
+        in_hunk=0
+        while IFS= read -r line; do
+            if [[ "$line" == @@* ]]; then
+                in_hunk=1
+                continue
+            fi
+            # Diff headers precede the first @@. Inside a hunk, even a line
+            # beginning "+++ " is added content (its first byte is the diff
+            # marker and the remaining "++ " belongs to the file).
+            [[ "$in_hunk" == 1 && "$line" == +* ]] || continue
+            added_line="${line:1}"
+            if printf '%s\n' "$added_line" | grep -qE "$SECRET_PATTERN" \
+                && ! parent_contains_line HEAD "$file" "$added_line" \
+                && { [[ -z "$MERGE_HEAD_REF" ]] || ! parent_contains_line MERGE_HEAD "$file" "$added_line"; }; then
+                add_critical "Possible hardcoded secret in staged file: $file"
+                break
+            fi
+        done <<< "$staged_diff"
     done <<< "$STAGED_FILES"
 
     # Check for .env files staged
@@ -361,3 +425,4 @@ fi
 log "Lightweight checks passed"
 echo '{}'
 exit 0
+