aa8333ccda
PreToolUse hooks route through kei-capability check when orchestrator registers a capability via KEI_CAPABILITY_NAME env var on agent spawn. hooks/agent-capability-check.sh (22 LOC): - Pass-through (exit 0) when KEI_CAPABILITY_NAME unset — no-op by default - Fail-open (exit 0) when kei-capability binary missing — kit convention - Sources _lib/gate.sh for KEI_DISABLED_HOOKS / KEI_HOOK_PROFILE respect - exec kei-capability check "$CAP_NAME" when active hooks/agent-capability-verify.sh (24 LOC): - Orchestrator-driven, NOT a Claude Code native hook - Carries env: AGENT_ID, TASK_TOML, WORKTREE_PATH, MAIN_REPO, RUN_MODE - exec kei-capability verify "$CAP_NAME" Registered in hooks/hooks.json + settings-snippet.json under both PreToolUse:Bash and PreToolUse:Edit|Write matchers. Internal NotApplicable returns exit 0 so non-matching tool calls cost nothing. install.sh unchanged — hooks/*.sh glob picks up both new files. tests/hook_wiring_integration.sh (64 LOC) — 3 contract assertions: (1) pass-through on unset KEI_CAPABILITY_NAME (2) deny+exit 2 on git-op pattern (3) allow+exit 0 on cargo-check pattern Multi-capability routing (for phase 5): KEI_CAPABILITY_NAME currently holds ONE name. When a role requires N capabilities, orchestrator will either iterate or kei-capability gains a compose subcommand. Design note left for phase 5. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
29 lines
1.2 KiB
Bash
Executable file
29 lines
1.2 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
# agent-capability-verify.sh — orchestrator-driven verify glue (phase 4).
|
|
#
|
|
# Called by the orchestrator after agent return (NOT by Claude Code's
|
|
# hook protocol directly). The orchestrator sets the full context in env:
|
|
# KEI_CAPABILITY_NAME — e.g. "quality::cargo-check-green"
|
|
# AGENT_ID — ledger agent id
|
|
# TASK_TOML — path to task.toml (parameterizes scope/output caps)
|
|
# WORKTREE_PATH — agent's worktree
|
|
# MAIN_REPO — orchestrator's main repo root
|
|
# RUN_MODE — worktree | simulated-merge
|
|
#
|
|
# Passes through stdin, stdout, exit code from kei-capability verify.
|
|
# Fail-open on missing binary (exit 0 + stderr note) — same convention as
|
|
# the check side; absence of the adapter must not crash the merge ceremony.
|
|
#
|
|
# See docs/AGENT-SUBSTRATE-SCHEMA.md §Verify execution.
|
|
set -eu
|
|
|
|
CAP="${KEI_CAPABILITY_NAME:-}"
|
|
if [ -z "$CAP" ]; then
|
|
echo "[agent-capability-verify] KEI_CAPABILITY_NAME unset — nothing to verify" >&2
|
|
exit 0
|
|
fi
|
|
command -v kei-capability >/dev/null 2>&1 || {
|
|
echo "[agent-capability-verify] kei-capability binary not in PATH — fail-open pass-through" >&2
|
|
exit 0
|
|
}
|
|
exec kei-capability verify "$CAP"
|