Use verified Python launchers for agent hooks

[Chris0Jeky]

Summary

• replace unusable native-Windows python hook launchers with the verified py -3 -B form
• make the Bash PreToolUse launcher fail closed: missing launcher or any policy-process failure maps to exit 2 with a stable diagnostic, while valid structured JSON remains exit 0
• model direct permissions on the actual surfaces: PowerShell(py -3 -B ...) on Windows and Bash(python3 -B ...) on POSIX, including a narrowly scoped renderer unittest rule on each
• make the smoke harness use its active sys.executable -B, inventory configured Python handlers independent of slash direction, reject duplicate/stale permissions, and exercise missing-launcher, missing-policy, forward-slash-regression, and command-lookup controls
• keep local failure-ledger update workflows render-before-test across both platforms and mirrors, while statically preserving Required CI's deliberate no-render gate
• synchronize failure-capture update order, command-not-found-safe guidance, seam maps, canonical docs, and the append-only failure ledger

This is a T4-class hook-configuration change. On 2026-07-27, the maintainer explicitly authorized agents to merge all PR types once their exact-head gates are satisfied.

Verification

• .mcp.json and .claude/settings.json parse successfully; py and node preflights pass
• native Windows CPython 3.14 (py -3): 6 hook files compile in memory, configured-handler smoke passes (including rc2, stable-diagnostic, and mutation controls), renderer suite 11/11
• native Windows CPython 3.13: 6 hook files compile in memory, configured-handler smoke passes, renderer suite 11/11
• WSL/POSIX exact-head direct utilities: both JSON files parsed; renderer ran; synchronization passed 11/11; normalized hashes and both diffs matched; tree clean
• all six mirrored Taskdeck skill validations pass
• failure-ledger JSONL/Markdown projection regenerated and synchronized
• node scripts/check-docs-governance.mjs
• node scripts/check-golden-principles.mjs
• node scripts/check-github-ops-governance.mjs
• git diff --check origin/main...HEAD
• backend/full frontend/Playwright suites (not run: no product runtime or UI files changed)

Documentation

• docs/STATUS.md updated
• docs/IMPLEMENTATION_MASTERPLAN.md updated
• docs/TESTING_GUIDE.md updated with platform-specific, fail-fast commands
• Codex/Claude failure-capture guidance and agent seam/parity maps updated
• failure-ledger history appended for Resolve a functional Python launcher for Windows agent utilities #1487 and the open native-PowerShell policy blocker Cover native PowerShell calls in Taskdeck's Claude deny floor #1497

Tracking

• Closes Resolve a functional Python launcher for Windows agent utilities #1487 (maintainer merge authorization recorded 2026-07-27)
• Issue Resolve a functional Python launcher for Windows agent utilities #1487 and PR Use verified Python launchers for agent hooks #1496 project items verified at Review / Priority II
• PowerShell-to-WSL handoff recurrence tracked separately as Document a deterministic PowerShell-to-WSL verification handoff #1495 (Pending / Priority II)
• Native PowerShell-tool deny-policy gap tracked separately as Cover native PowerShell calls in Taskdeck's Claude deny floor #1497 (Priority I, T4)

CI Workflow Validation

• Required CI green on exact head 3d66cc0b (run 30201593348; 16/16 jobs)
• CI Extended green on exact head 3d66cc0b (run 30201593328; required because scripts/ changed)
• CodeQL green on exact head 3d66cc0b (dynamic run 30201591953; 4/4 analyses)

Risk Notes

• Security boundary: the configured PreToolUse matcher and policy still evaluate Bash payloads only. The native-Windows smoke proves Bash payloads passing through PowerShell-hosted handlers; it does not prove native PowerShell-tool interception. Cover native PowerShell calls in Taskdeck's Claude deny floor #1497 owns that T4 policy change.
• Failure posture: launcher lookup errors and policy-process failures now block with exit 2 instead of degrading to a non-blocking hook error.
• Compatibility: POSIX direct utilities remain on python3 -B; no interpreter install, global PATH mutation, resolver wrapper, deny regex, product runtime, or product authorization behavior is changed.
• Merge authority: the maintainer explicitly authorized agents to merge all PR types on 2026-07-27; exact-head technical gates remain mandatory.
• Follow-ups: Document a deterministic PowerShell-to-WSL verification handoff #1495 owns deterministic PowerShell-to-WSL multi-step command handoff guidance; Cover native PowerShell calls in Taskdeck's Claude deny floor #1497 owns native PowerShell deny-policy coverage.

[Chris0Jeky]

Deliberate self-review — exact head 8c2ef1e7

I swept the PR conversation, review submissions, and inline threads before posting: all three were empty.

CRITICAL

None.

HIGH

None.

MEDIUM

1. scripts/agent_hooks/smoke_test.py — incomplete permission sets could pass the first launcher check. The first implementation only required every matching rule to use an approved prefix and at least one rule from each launcher family. A missing utility/launcher pair could therefore escape the self-test. Expected fix: assert the exact five utilities × two launchers and reject missing or unexpected rules.
2. scripts/agent_hooks/CLAUDE.md, docs/TESTING_GUIDE.md, autodoc/AGENT_INDEX.md — false POSIX full-smoke claim. The initial guidance told POSIX users to run smoke_test.py, but the harness intentionally executes configured handlers that declare shell: powershell. Expected fix: reserve full configured-handler smoke for native Windows and keep POSIX proof to direct utilities.
3. docs/TESTING_GUIDE.md and mirrored failure-capture guidance — copied sequences could mask failures. Native commands lacked per-step $LASTEXITCODE checks, the POSIX sequence lacked global fail-fast behavior, and the Windows validator path was unquoted. Expected fix: fail loudly on a missing launcher and stop after every failed native step.

LOW

None.

Out-of-scope tracked finding

• Repeated PowerShell→WSL quoting/CRLF handoff failures during POSIX verification are real but outside this launcher PR; tracked with concrete acceptance criteria as Document a deterministic PowerShell-to-WSL verification handoff #1495.

Residual risk

This changes a T4-class hook boundary and remains intentionally human-held. POSIX direct utilities are verified, but the Windows PowerShell configured-handler contract is not claimed as POSIX-portable.

[Chris0Jeky]

Review fix evidence — exact head 8c2ef1e7

• MEDIUM 1 → fb773350: replaces prefix-family checks with exact set equality over all 5 utilities × both approved launchers. Missing and unexpected rules are reported explicitly. Verified by sequential native-Windows smoke passes under CPython 3.14 and 3.13.
• MEDIUM 2 → 8c2ef1e7: scopes smoke_test.py to native Windows wherever documented; POSIX guidance now covers direct JSON/syntax/renderer utilities only. Verified under WSL CPython 3.11: both JSON files parsed, 6 hook sources compiled in memory, renderer suite passed 11/11, and rendering completed.
• MEDIUM 3 → 8c2ef1e7: adds a checked py preflight, quotes the Windows validator path, checks every native exit code, and uses set -eu for POSIX blocks. The mirrored failure-capture snippets use $LASTEXITCODE / set -e.
• Out-of-scope handoff friction → Document a deterministic PowerShell-to-WSL verification handoff #1495 with reproducible quote/LF cases and fail-propagation acceptance criteria.

Additional exact-head evidence:

• six mirrored skill validations: 6/6 valid
• renderer suite: 11/11 on CPython 3.14 and 11/11 on CPython 3.13
• governance: docs, golden principles, and GitHub operations all pass
• failure-ledger projection hash stable after render
• git diff --check origin/main...HEAD: clean
• DCO: 3/3 commits contain Signed-off-by

Fresh self-review of the fixed diff found no additional CRITICAL/HIGH/MEDIUM/LOW findings. The T4 human merge hold remains.

[Chris0Jeky]

@codex review

Please review exact head 8c2ef1e7e1f3f1428c50f753836a7453f9fcba69, including the T4 launcher/config boundary, exact permission-matrix assertion, native-Windows versus POSIX evidence claims, fail-fast copied commands, and append-only failure-ledger truth.

[Chris0Jeky]

Fresh adversarial review — exact head 8c2ef1e7e1f3f1428c50f753836a7453f9fcba69

Verdict: changes requested.

I inspected all existing PR discussion before submitting: 3 issue comments (self-review, fix evidence, and the review request), 0 prior submitted reviews, and 0 inline review threads. I independently reviewed the live exact-head diff and the unchanged hook policy source.

CRITICAL

None.

HIGH

1. The PreToolUse launcher fails open when py or the Python policy process is unavailable. A shell-form command-not-found returns 1; Claude Code documents that PreToolUse exit codes other than 2 are non-blocking, so the attempted tool call proceeds without the deny floor. The manual smoke/preflight is not an active runtime guard. Map launcher/policy failures to blocking exit 2 and test the unavailable/broken-launcher path. See the inline finding and the Claude hook exit-code contract.
2. The native PowerShell tool is outside both project deny layers. The hook matcher is Bash only, the Python policy ignores tool names other than Bash/Shell, and the static denies are all Bash(...). Running the handler under PowerShell with a Bash payload does not test native PowerShell interception. Extend and canary the PowerShell path, or explicitly de-scope and track the security gap before this T4 configuration merges. Claude documents PowerShell as a distinct Windows tool and permission surface: tools reference, permissions.

MEDIUM

1. The asserted allow-rule matrix does not authorize the copied Windows workflow. It expects Bash(py ...) rules even though the Windows commands are documented for PowerShell, whose permissions are separate. It also omits the documented py -3 -B -m unittest ... renderer-test command. Align the rules and matrix test with the actual tool/platform invocations.

LOW

None.

Evidence

• Live PR head remained the reviewed SHA immediately before review creation.
• Exact-head .claude/settings.json parsed successfully.
• Exact-head smoke_test.py compiled in memory under CPython 3.14 and 3.13.
• The policy-script blobs are identical at base, reviewed head, and local main; direct py -3 -B and py -3.13 -B probes both emitted the expected structured deny for git restore --worktree.
• A missing-command PowerShell probe exited 1, which is non-blocking under the documented PreToolUse contract.
• git diff --check base...head passed.
• Current local Claude Code: 2.1.219.

Residual risk / NOT verified

• No live Claude /hooks inventory or real PowerShell-tool deny canary was run.
• Hosted exact-head checks were still in progress during review.
• No product/backend/frontend suites were run; the PR does not touch product runtime/UI files.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8c2ef1e7e1

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Chris0Jeky]

Review repair evidence — exact head f5f9773cc75dcda9f7a32018a8f2246328a707a8

All six findings are addressed in signed commit f5f9773c:

1. HIGH — PreToolUse fail-closed launcher: the PowerShell wrapper now maps command lookup failures and every nonzero policy-process result to hook exit 2, emits a stable policy-failure diagnostic, and preserves exit 0 plus structured JSON on success. Smoke coverage proves missing launcher and missing policy path both return exactly 2.
2. MEDIUM — permission surfaces: Windows direct utilities are now PowerShell(py -3 -B ...); POSIX remains Bash(python3 -B ...); each platform also has a narrowly scoped renderer unittest permission. The test asserts five utilities plus that unittest on each actual surface.
3. HIGH — native PowerShell bypass: this PR no longer claims native PowerShell-tool interception. Canonical docs, seam/parity guidance, and the smoke description now state that the Windows host receives Bash payloads only. The confirmed T4 blocker is recorded open in the failure ledger and tracked by Cover native PowerShell calls in Taskdeck's Claude deny floor #1497 (Priority I).
4. MEDIUM — command lookup false success: the copied Windows blocks set $ErrorActionPreference = 'Stop', preflight their native tools (py, plus node in the testing sequence), write errors via [Console]::Error.WriteLine, and exit nonzero. The smoke matrix includes a missing-command preflight canary that must exit 17 rather than false-success.
5. P2 — slash-sensitive handler inventory: configured Python handler paths are found with a slash/backslash-insensitive regex and checked against the exact script multiset. A mutation control converts a handler to forward slashes plus bare python and proves validation rejects it. Permission inventory is separator-insensitive and Counter-based; a duplicate-rule mutation must also fail.
6. P2 — failure-ledger update order: both failure-capture skill mirrors now render an appended JSONL entry before running the synchronization unittest. They explicitly distinguish this update workflow from Required CI's deliberate fail-before-render gate.

Local verification

• .claude/settings.json JSON parse and py/node preflight: passed
• configured-handler smoke: passed on CPython 3.14 (py -3) and 3.13
• hook-source in-memory compile: 6 files passed on CPython 3.14 and 3.13
• renderer synchronization suite: 11/11 passed on CPython 3.14 and 3.13 after regeneration
• WSL/POSIX exact-head direct gate (coordinator): .mcp.json and .claude/settings.json parse, renderer suite 11/11, direct renderer exit 0; normalization-only stat dirt was refreshed and the worktree/index remained clean
• mirrored skill validation: 6/6 passed
• docs governance, golden principles, GitHub-ops governance: all passed
• git diff --check origin/main...HEAD: passed

Not run on this exact head: backend, frontend, or Playwright. No product runtime/UI files changed; CI remains required on this exact head before any maintainer merge decision.

[Chris0Jeky]

@codex review

Please perform a fresh adversarial review of exact head f5f9773cc75dcda9f7a32018a8f2246328a707a8 after the six-thread repair batch. Focus on:

• blocking exit-2 semantics for missing launcher and every nonzero PreToolUse policy process while preserving successful structured JSON
• exact platform/tool permission inventory, including renderer unittest, separator variants, and duplicates
• whether command-not-found-safe copied PowerShell blocks can still false-success
• render-before-test update workflow versus the intentionally unchanged CI fail-before-render gate
• truthful Bash-payload-only evidence and explicit Cover native PowerShell calls in Taskdeck's Claude deny floor #1497 native PowerShell-tool policy boundary
• append-only failure-ledger integrity and docs claim accuracy.

This remains a draft, human-held T4 change. Please do not infer native PowerShell interception from a PowerShell-hosted handler receiving a Bash payload.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f5f9773cc7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Chris0Jeky]

Review repair evidence — exact head f2551ebfd987bccfe7eab8f4a1e459629ad7b942

• P2 local ledger order → f2551ebf: Windows and POSIX local sequences now render failure_ledger.jsonl into the Markdown projection before running synchronization, so a valid hook-appended row cannot abort before projection.
• Mirror sweep → f2551ebf: corrected the same order in scripts/agent_hooks/CLAUDE.md; both failure-capture skill mirrors were already render-first.
• Recurrence prevention → f2551ebf: the smoke matrix asserts render-before-test across seven local platform/mirror contracts and separately asserts that .github/workflows/reusable-docs-governance.yml contains the synchronization test but no renderer. Required CI behavior was not changed.
• Canonical truth → f2551ebf: STATUS and MASTERPLAN now state the intentional distinction rather than claiming local and CI order are identical.

Exact-head verification

• JSON plus py/node preflight: passed
• configured-handler smoke: passed on CPython 3.14 and 3.13
• in-memory compile: 6 hook files passed on CPython 3.14 and 3.13
• local render followed by synchronization suite: 11/11 passed on CPython 3.14 and 3.13
• mirrored skill validation: 6/6 passed
• docs, golden-principles, and GitHub-ops governance: passed
• git diff --check origin/main...HEAD: passed

All review and CI evidence attached to f5f9773c is stale after this push. WSL/POSIX runtime proof, Required CI, CI Extended, CodeQL, and fresh adversarial review are pending on f2551ebf. This remains draft and human-held; #1497 is unchanged and out of scope.

[Chris0Jeky]

@codex review

Please perform a fresh adversarial review of exact head f2551ebfd987bccfe7eab8f4a1e459629ad7b942.

Focus on the repaired failure-ledger ordering contract: local Windows/POSIX update workflows must render before synchronization testing, while Required Docs Governance must continue testing the checked-in projection without running a renderer. Please also examine whether the new static smoke assertions cover every copied local mirror without weakening the existing launcher, fail-closed, or #1497 boundary claims.

All prior exact-head review and CI evidence is invalid after this push. The PR remains draft and human-held.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Bravo.

Reviewed commit: f2551ebfd9

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Chris0Jeky]

Fresh adversarial review — exact head f2551ebfd987bccfe7eab8f4a1e459629ad7b942

Verdict: one LOW finding; no CRITICAL, HIGH, or MEDIUM findings.

I re-read all current PR discussion before submission: 8 issue comments, 10 submitted reviews, and all 7 inline threads (all resolved). The new Codex no-major-issues comment is informational. I independently reviewed the complete 12-file 6fd39367...f2551ebf diff, the linked #1487 scope, open #1497 de-scope, and the unchanged Required Docs Governance workflow.

CRITICAL

None.

HIGH

None.

MEDIUM

None.

LOW

1. The missing-launcher catch path does not emit the stable diagnostic claimed by the PR. It blocks correctly with exit 2, but writes only PowerShell's environment-/localization-dependent exception text; the fixed Taskdeck blocking message and assertion cover only nonzero policy-process failures. See the inline finding.

Prior-thread disposition

The six findings repaired at f5f9773c and the render-order finding repaired at f2551ebf are individually resolved in their threads. The full diff now preserves exit-2 blocking, the exact platform/tool permission inventories, command-not-found-safe copied workflows, Bash-payload-only claims, and the explicit #1497 native-PowerShell boundary. The new static contract covers all seven copied local render-before-sync sequences and separately requires Required Docs Governance to retain the synchronization test without invoking the renderer.

Exact-head evidence

• Guarded worktree was clean and at f2551ebfd987bccfe7eab8f4a1e459629ad7b942.
• .mcp.json and .claude/settings.json parsed successfully.
• Configured-handler smoke passed on native Windows CPython 3.14 and 3.13.
• Renderer synchronization suite passed 11/11 on both CPython 3.14 and 3.13.
• All six mirrored skill validations passed.
• Docs, golden-principles, and GitHub-operations governance checks passed.
• git diff --check 6fd39367...HEAD passed; worktree remained clean.
• Focused wrapper probes: arbitrary policy exit 17 mapped to exit 2 with the fixed diagnostic; missing launcher mapped to exit 2 but emitted only the PowerShell exception, reproducing the LOW finding.
• Immediately before submission, the live head still matched the reviewed SHA. At the last check-run read, 23 checks were successful, 11 skipped, and the Windows API Integration job remained in progress.

NOT verified / residual risk

• WSL/POSIX direct utilities were not rerun on this head.
• No fresh interactive Claude /hooks inventory or live allow/deny canary was run.
• Native PowerShell-tool interception is intentionally not claimed and remains open as Priority-I T4 issue #1497.
• Backend/full frontend/Playwright suites were not run locally because no product runtime/UI files changed.
• The PR remains draft and human-held; hosted exact-head gates and the LOW finding must be settled before any merge decision.

[Chris0Jeky]

Review repair evidence — exact head 3d66cc0b71aeb78d1ad1a60bde97ffcf5ae0e8ba

• LOW stable launcher diagnostic → 3d66cc0b: the PreToolUse catch emits a deterministic Taskdeck-owned handler-launch failure line and exits 2, without depending on PowerShell exception wording or locale.
• Focused regression → 3d66cc0b: the missing-launcher control now requires both exact exit 2 and the exact stable stderr diagnostic. The missing-policy control continues to require its distinct fixed policy-process diagnostic.
• Scope: no deny matcher, policy rule, permission surface, canonical documentation, CI workflow, or Cover native PowerShell calls in Taskdeck's Claude deny floor #1497 boundary changed.

Exact-head local verification

• .claude/settings.json JSON parse: passed
• configured-handler smoke: passed sequentially on CPython 3.14 and 3.13
• hook-source in-memory compile: 6 files passed on CPython 3.14 and 3.13
• failure-ledger renderer suite: 11/11 passed
• docs, golden-principles, and GitHub-ops governance: passed
• git diff --check origin/main...HEAD: passed
• DCO: new commit contains Signed-off-by

All review and CI evidence attached to f2551ebf is invalid after this push. WSL/POSIX runtime proof, Required CI, CI Extended, CodeQL, and fresh adversarial review are pending on 3d66cc0b. The PR remains draft and human-held.

[Chris0Jeky]

@codex review

Please perform a fresh adversarial review of exact head 3d66cc0b71aeb78d1ad1a60bde97ffcf5ae0e8ba.

Focus on whether both PreToolUse failure classes now remain fail closed with deterministic Taskdeck-owned diagnostics: launcher/handler invocation failure must return exit 2 plus Taskdeck PreToolUse handler launch failed; blocking command., while a launched policy process returning nonzero must return exit 2 plus its fixed policy-process message. Confirm successful structured JSON still exits 0 and that the focused smoke controls genuinely exercise both paths.

All prior exact-head review and CI evidence is invalid after this push. Do not broaden into the separately tracked #1497 PowerShell-tool policy gap; this PR remains draft and human-held.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Keep them coming!

Reviewed commit: 3d66cc0b71

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Chris0Jeky]

Fresh adversarial review — exact head 3d66cc0b71aeb78d1ad1a60bde97ffcf5ae0e8ba

Verdict: clean. No CRITICAL, HIGH, MEDIUM, or LOW findings.

I re-read all current PR discussion before submission: 11 issue comments, 12 submitted reviews, and all 8 inline threads. Every prior thread is resolved, including the stable-diagnostic LOW repaired by 3d66cc0b; the exact-head Codex no-major-issues comment is informational. I independently reviewed the complete 12-file 6fd39367...3d66cc0b diff, linked #1487, open #1497, and the unchanged Required Docs Governance workflow.

CRITICAL

None.

HIGH

None.

MEDIUM

None.

LOW

None.

Contract review

• Missing launcher/handler invocation returns exit 2 with exactly Taskdeck PreToolUse handler launch failed; blocking command..
• A launched policy process returning arbitrary nonzero (probed with 17) returns exit 2 with the distinct fixed policy-process diagnostic.
• Safe Bash payloads and structured denials still exit 0; the deny result remains structured JSON with permissionDecision: deny.
• The exact configured Python-handler multiset and the five-utilities-plus-renderer-test permission inventories remain pinned per platform, with forward-slash and duplicate mutation controls.
• Copied Windows command lookup fails loudly rather than inheriting a stale $LASTEXITCODE.
• Seven local Windows/POSIX/mirror contracts remain render-before-synchronization, while Required Docs Governance retains its synchronization test and contains no renderer.
• Claims remain explicitly Bash-payload-only; native PowerShell-tool interception is not inferred and remains the open Priority-I T4 boundary in #1497.
• The failure-ledger change remains append-only and its checked-in projection is synchronized.

Exact-head evidence

• Guarded worktree was clean and at 3d66cc0b71aeb78d1ad1a60bde97ffcf5ae0e8ba.
• Both JSON configuration files parsed and Windows py / node preflights passed.
• All six hook sources compiled in memory on CPython 3.14 and 3.13.
• Configured-handler smoke passed on CPython 3.14 and 3.13.
• Renderer synchronization suite passed 11/11 on both interpreters.
• All six mirrored skill validations passed.
• Docs, golden-principles, and GitHub-operations governance checks passed.
• git diff --check 6fd39367...HEAD passed; the worktree remained clean.
• Immediately before submission, the live PR head still matched the reviewed SHA.
• At the final pre-review check read, 22 jobs were successful, 11 skipped, and the Windows and Ubuntu API Integration jobs were still in progress.

NOT verified / residual risk

• I did not independently rerun the WSL/POSIX direct-utility gate in this Windows-focused review.
• No fresh interactive Claude /hooks inventory or live allow/deny canary was run.
• Native PowerShell-tool interception remains explicitly outside this PR and tracked by #1497.
• Backend/full frontend/Playwright suites were not run locally because no product runtime/UI files changed.
• The PR remains draft and human-held; exact-head hosted gates must finish green before any maintainer merge decision.

[Chris0Jeky]

Independent POSIX/docs-governance adversarial review — exact head 3d66cc0b71aeb78d1ad1a60bde97ffcf5ae0e8ba

Verdict: clean. No actionable CRITICAL, HIGH, MEDIUM, or LOW findings.

I started cold from all 11 issue comments, all 13 submitted reviews, and all 8 inline threads (all resolved), then reviewed the complete 6fd39367...3d66cc0b71aeb78d1ad1a60bde97ffcf5ae0e8ba diff across all 12 changed files.

Findings

• CRITICAL: None.
• HIGH: None.
• MEDIUM: None.
• LOW: None.

POSIX, governance, and claim evidence

• Direct WSL/POSIX checks on this exact clean worktree used Python 3.11.2: both JSON files parsed, all six hook sources parsed in memory, and the renderer synchronization suite passed 11/11.
• The stable diagnostics did not regress portability: the Taskdeck-owned launcher and policy-failure lines are ASCII/stable, the POSIX direct commands remain python3 -B, and the PowerShell-hosted handler is accurately described as receiving Bash payloads rather than proving native PowerShell-tool interception.
• All seven copied local update contracts contain render-before-synchronization order. Required Docs Governance still runs the checked-in projection synchronization test and has no renderer invocation.
• The failure ledger remains append-only in JSONL, and the Markdown projection reflects the new #1487/#1497 rows without rewriting earlier history.
• #1497 is correctly scoped as the separate Priority I/T4 native PowerShell-tool deny-policy gap; #1495 retains the PowerShell-to-WSL handoff concern.
• git diff --check passed and the review worktree remained clean.

Not independently re-run

• I did not invoke the renderer entrypoint because this review was read-only; the 11/11 synchronization suite independently compared the checked-in projection.
• I did not re-run the native-Windows configured-handler smoke, backend/frontend/Playwright suites, or mutate canaries. The exact-head hosted checks were still completing when this review began.

Residual risk

This remains a human-held T4 hook/configuration change. Native PowerShell-tool interception is intentionally not established here and remains blocked on #1497. Any head change invalidates this review.

[Chris0Jeky]

Exact-head verification checkpoint — 3d66cc0b71aeb78d1ad1a60bde97ffcf5ae0e8ba

PR #1496 is implementation-verified and remains intentionally draft/human-held.

Exact-head gates

• coordinator Windows: CPython 3.14 and 3.13 configured-handler smoke passed; renderer synchronization passed 11/11 on each; six skill validators and three governance gates passed
• coordinator WSL/POSIX direct gate: both JSON files parsed, renderer ran, synchronization passed 11/11, normalized index/worktree hashes matched, both diffs were empty, and the worktree remained clean
• DCO: 6/6 PR commits contain Signed-off-by
• diff/base: git diff --check passed; PR base and current origin/main are both 6fd39367; branch and remote head match
• independent exact-head reviews: 4781716836 and 4781731234, both clean at every severity
• fresh Codex: comment 5083424296, no major issues on 3d66cc0b
• Required CI 30201593348: success, 16/16 jobs including E2E Smoke
• CI Extended 30201593328: success
• CodeQL dynamic run 30201591953: success, 4/4 analyses
• review threads: 8 total, 0 unresolved; closing references: 0
• project fields: issue Resolve a functional Python launcher for Windows agent utilities #1487 and PR Use verified Python launchers for agent hooks #1496 are both Review / Priority II

Held boundary

No merge was attempted. This changes a T4 hook/configuration boundary and requires a maintainer merge decision. Native PowerShell-tool interception remains explicitly outside this PR and tracked by Priority-I #1497. Backend/full frontend/Playwright were not rerun locally; the exact-head Required CI matrix, including E2E Smoke, is green.