v1.1.7 — hooks fail visible, bounds script, pathspec rule

The 1.1 spec is unchanged. This release fixes a documented enforcement gap, turns one piece of standing advice into a check, and folds in the one commit-hygiene delta that had cleared the n=2 gate.

A documented limit was a defect.

The README said it plainly: "jq — required by the default (bash) hooks; without it they silently no-op." A hygiene gate that quietly disables itself is worse than none, because the session believes it is enforced. The three bash hooks now say so — the hygiene gate asks on any git command, the freshness gate and the orphan check inject a context line — and test_git_hygiene.py runs them on a PATH without jq to prove it. The Node twins already failed safe; the bash twins did not.

New in this release

• adp_bounds.py — mechanical caps on current.md (lines, bytes, Dispatch block) and the memory read layer; exit 1 on a breach, --strict for warnings. "Keep it small" is now a check a hook or CI can run. Installed by init.*, removed by uninstall.*, with its own tests
• §6.4 rule 1, pathspec form — git commit -m "…" -- <paths>. A bare git commit snapshots the whole shared index, so a co-session's staged files are swept in however carefully you staged. Ratified at n=2 from sweep incidents on both installs; generalised into rule 1 in place rather than numbered as a sixth. Both hook twins note a commit that carries no pathspec
• Four notations, no rules — Supersedes: on tasks and plans (how a decision retires the previous one); provenance tags [read: …] [calc: …] [hyp: …] on reused values; a three-part BLOCKED body (question · candidate answers · what each changes); a retro question on automations that run unattended
• §5.3 "locate, don't extract" — a cheap tier may locate; a count, value or list it hands back is a pointer, not a fact. Indexes existing checks (review step 5, S6)
• protocolreview.md v0.3 — the four homes of a fix, a dependency column for hooks, a supersession scan, and a standing rule to recheck any import scan adversarially before editing

What the recheck caught. The import scan behind this release was itself rechecked by a second agent before anything was edited. Of eight "ADP lacks X" claims in the first pass, two were wrong and four overstated — the shape already existed at review cadence. The one real defect the scan had missed, the silent jq no-op, was the most valuable item of the run. The protocol review now requires that recheck.

Nothing advanced an n-counter. The scan's material came from outside ADP installs. Four candidates entered at n=0 in proposals/ADP-1.2-candidates.md; the pathspec rule is the only change with install receipts behind it.

The fastest way to test this on your own work is still the six-class semantic checklist: run it against your team's next ten specifications and report what it caught. Zero catches is a result worth reporting.

Preprint: doi:10.5281/zenodo.21982389