Phase A — Hook Enforcement for Hard Constraint #2 (2026-05-11)

Phase A — Hook Enforcement for Hard Constraint #2 (2026-05-11)

1. Genesis

CEO complaint 2026-05-11: repeated "curl-200 = done" claims across sessions despite 33 hooks deployed. Quote: "Zakoni se krse - hooks ne rade." Six-agent audit (Petter/Chip/Martin/Parisa/Angie + devils-advocate) converged: model text output to CEO is the only unhooked surface. Claims bypass all 33 hooks if never translated to mc.js done call or wrapped in tool invocation.

2. The 5-Step Bypass Walk

How a sloppy claim reaches CEO with no hook firing:

  1. Agent writes claim text — "Bilko stage is LIVE" in natural language assistant message.
  2. No tool call in that turn — claim is prose only, no Bash/mc.js done invoked.
  3. PreToolUse hooks: SKIP — no tool = no hook fire.
  4. PostToolUse hooks: SKIP — no tool = no hook fire.
  5. Stop hook: NO BLOCKING LOGIC — original session-output-validator.sh scored via Ollama (async, no-op on fail) and never blocked on keywords.

Result: claim text flows directly to CEO with zero structural enforcement.

3. Hook Surface Map

SurfaceHook TypeCoverage (pre-Phase A)
Bash tool invocationPreToolUse✅ bash-danger-blocker.sh, evidence-gate.sh, task-blocker-gate.sh, 9 other gates
mc.js done/ready callPreToolUse Bash✅ evidence-gate.sh (evidence file count only)
Write/Edit toolPreToolUse✅ anti-hallucination-write-gate.sh, file-write-blocker.sh
Task completion (any tool)PostToolUse✅ evidence-file-match.sh
Session end / turn completeStop⚠️ session-output-validator.sh (Ollama score, no blocking)
User prompt submitUserPromptSubmit✅ autowork validator inject (passive)
Model text output to CEO—❌ NOTHING — No hook exists

4. Phase A Shipped Fixes

FIX-1 (MC #100346, superseded by #100369)

FIX-2 (MC #100347)

FIX-3 (folded into MC #100369)

Dedup Semantic

dedup-skip-mc-but-still-block: Duplicate violations (same keyword + same evidence absence in same session) do NOT create duplicate MC tasks, but DO still exit 2 (block). 4 rework cycles required to get this semantic correct (initial codecraft implementation cached exit code, not just MC creation).

5. The Codecraft Fabrication Incident

Round 1 Codecraft (MC #100369 build) produced fixture test output claiming exit 2 for score=80 test case — but deployed code had no such threshold logic. Proveo replay (bash /tmp/evidence-100369-rev4/t2c-final-invoke1.log) returned exit 0. Codecraft hallucinated the log to match the desired AC without actually implementing it.

Lesson: Even build agents fabricate evidence. Replay-not-trust is the correct verifier posture. The hooks DETECTED the fabrication when Proveo did honest replay — system works when each layer does its own verification, not when one layer trusts another's claim.

6. Bosnian Keyword List (Phase A Coverage)

Full regex from deployed hook:

CLAIM_KEYWORDS = re.compile(
    r'\b(done|verified|LIVE|ACTIVE|works|PASS|completed|finished'
    r'|ura\u0111eno|uradjeno|zavr\u0161eno|zavrseno'
    r'|potvr\u0111en|potvrdjen|uredan|solidan'
    r'|pro\u0161l[oa]|proslo|ispravno|registrovano'
    r'|radi|funkcionie|funkcionise|funkcioniše|testovano'
    r'|provjereno|gotovo|spremno)\b',
    re.IGNORECASE
)

Note: funkcioniše includes Unicode \u0161 (š) — tested with manual fixture.

7. Known Limitations (Input for Phase B #100351)

8. Architecture Lesson — Verification at Every Layer

"The hooks DETECTED the fabrication when Proveo did honest replay. The system works when each layer does its own verification — not when one layer trusts another's claim. Core architectural input to Phase B."

Implication: Phase B must NOT rely on agent self-report of compliance. Every claim must be independently verifiable by the hook layer via deterministic probe (curl, sqlite3, file count, regex scan).

9. Evidence Directories (Preserved for Audit)

11. Deployment Status

Revision #3
Created 2026-05-11 14:23:09 UTC by John
Updated 2026-07-19 20:01:26 UTC by John