Skip to main content

BookStack task lifecycle enforcement — ANVIL Claude Code

BookStack task lifecycle enforcement — ANVIL Claude Code

Status: IMPLEMENTED / live verification complete

Date: 2026-08-21

Scope: /Users/makinja/system and the active Claude Code hook configuration on ANVIL

Mission Control: #900118

Problem

The active Claude Code configuration did not enforce the operating requirement that task documentation be read before work and updated after work. The task-scoped pilot-discover-inject.py path returned immediately when MC_TASK_ID was present, mc.js start only warned for a subset of tasks, and mc.js done accepted an unverified URL string in free text.

Before-work plan

  1. Add a deterministic BookStack task-page verifier that uses the BookStack API, accepts only canonical https://docs.alai.no/... pages, and checks task-specific lifecycle markers.
  2. Make mc.js start fail closed for every real MC task unless its linked page exists and contains a task-specific BEFORE marker.
  3. Make mc.js ready and mc.js done fail closed unless the same page contains the AFTER marker and its API updated_at is newer than the baseline captured at start.
  4. Store the API verification timestamps/page identity on the MC task so a pasted URL or unrelated old page cannot satisfy the gate.
  5. Repair task-scoped context injection so the linked BookStack page content is placed in front of the worker instead of being skipped.
  6. Add bidirectional tests: valid lifecycle passes; missing URL, wrong host, missing marker, stale page, changed page, and API failure block.
  7. Re-run the hook inventory and targeted negative tests; list residual hook problems honestly instead of claiming all hooks are healthy.

Independent verification task

MC #900119 is the read-only Proveo review of this implementation.

Acceptance criteria

  • BEFORE proof is mandatory before the task can transition to active work.
  • AFTER proof is mandatory before review/completion.
  • Free-text docs.alai.no mentions do not satisfy completion.
  • API failure is UNKNOWN and blocks lifecycle transitions; it is never treated as PASS.
  • Tests do not contact or mutate production BookStack or the live Mission Control database.

After-work results

  • Deployed to live ~/system in commit 6092564c8 (source review commit 9b4d34410).
  • mc.js start/resume/run start/session start now require API-verified BEFORE proof.
  • mc.js ready/done now require the same page, exact AFTER marker, and API updated_at newer than the captured baseline. --force and outcome text cannot bypass this gate.
  • Task page identity and BEFORE/AFTER verification timestamps are stored on the MC task; concurrent page/task mutation invalidates persistence.
  • Task-scoped pilot-discover-inject.py now injects the exact API-read-back BookStack page instead of skipping every MC_TASK_ID worker. Live probe for #900118 returned status=VERIFIED and included its BEFORE marker.
  • Duplicate registrations from settings.local.json were removed; exact duplicate (event, matcher, command) registrations are now zero.
  • Syntax/JSON checks pass and targeted regression tests pass 31/31 against live files.
  • Live BookStack API canary passed for page 3399; a different task id was rejected with BEFORE_MARKER_MISSING, exit 2.
  • Independent Gemini CLI review of 9b4d34410 returned PASS, P0=0, P1=0. Durable capture: ~/system/evidence/900118/gemini-independent-review.json.

MC #900119's automated Proveo/local-model route timed out and is not represented as a Proveo PASS. It was superseded by the independent Gemini review above.

Residual hook audit findings

This task fixes BookStack lifecycle enforcement and duplicated registrations. It does not claim that every other hook is healthy: the Kotlin alai-hooks large-input StackOverflow class, direct SQLite resource bypass, advisory-only gates, and incomplete negative-test coverage remain separate verified audit findings.

Back to top