@@ -5,7 +5,9 @@
 
 ## 当前未发布实现候选
 
+- **Grok Stop 完成硬续 + EnforcementHonesty（20260726）**：`lifecycle-stop-gate.cjs` + lifecycle Stop 接线；`adaptGrokOutput`/`blockOutput` 保留 Stop `decision:block`；R9 `pr1-skipped`；R10 扩展 `CONTROL_PLANE_SOURCE_RE`（host-projections/host-parity）并复用 `checkCpGate`（safety-only 披露 `cp2-unconfirmed-write`）；compliance/report/dev-default/cp-gate/dev-plan-review Honesty+R12 顺序索引；cannotClaim 改为「无正文/softCap fail-open」；探针 `test-lifecycle-stop-gate.js` + host-adapters/parity 更新。需求：`20260726-grok-stop-enforcement-honesty` B1–B4+B2b。
 - **工作区 Skill 双层 resolve（S2 / W>G）**：新增 `hooks/_runtime/skill-resolution.cjs`（唯一 Owner）：`workspace-namespace` 下 `.devcodex/workspace/skills` 优先于 `~/.agents/skills`，**reserved** skill id 禁止 W 覆盖；同次 digest/content 契约；`profile_skill_plan` / `BundleDecisionV2` 附加 `resolutionPlan` 并改写 selected source identity；Hook 对 workspace-skill 做 managed/control-plane carve-out；CLI `devcodex skill resolve`；`npm run test:skill-resolve`（含 hook 路径矩阵；并入 `test:control-plane`）；`validation-manifest` 节点 `skill-resolve` + `skill-resolution-hook-paths` 进入 fast/full/profile-deploy/package-release；apply 目标禁入 W 树。需求：`双层Skill用户优先与意图加载` CP2 v1.2 S2 / CP3。
+- **WorkspaceSkillAutoMatch（P0.5 用户可见闭环 / PF-213）**：新增 `hooks/_runtime/workspace-skill-auto-match.cjs`：UserPromptSubmit 按 W skill `name`/`description` 引号触发语/id 匹配 → `resolveSkillRead` → `additionalContext` 注入正文（Claude/Codex 等 inject 宿主）；Grok UPS 仍诚实不宣称 inject，但 **Stop `decision:block`** 在回复未遵守 skill 时强制再答一轮（官方 Stop Decision Control）；CLI `devcodex skill match <prompt>`；探针 `test-workspace-skill-auto-match.js` / manifest 节点 `skill-auto-match`。禁止仅 CLI resolve 绿冒充「发 test 即生效」。
 - **SourceExistenceVerificationGate（规范吸纳防复发）**：`spec-absorption` 强制在输出「可吸纳」前对 source-root 做同名/近邻存在性验证；台账 `open/pending absorption` 不得单独成 absorb。`AbsorptionCandidateMatrixV1` 增加 `sourceExistence`；planner 阻断 `unverified` 与 `present/equivalent-covered` 的 absorb；并列「可关账清单」。负向：ledger-status-only。验证：`node scripts/plan-absorption-candidates.js --self-test`、`npm run test:residual-absorption-controls`、V81 needles。
 - **ExecutableAbsorption + ProbeNecessity（假吸纳禁止）**：吸纳必须可执行——`enforcementLevel` 不得为 checklist-only/none；每条 absorb 必填 `probeNecessity`（required/conditional/not-required/forbidden、alwaysOnImpact、复杂度与误报）。只写 Skill 正文或「以后再补探针」不得 ready/absorbed。分类器 `classifyExecutableAbsorptionSample`。验证：planner self-test + residual + V81。
 - **可执行吸纳主包 A 实施（R1～R4 + T2）**：`ProgressReportFastPath`（skill-gap/compliance/SC16）；`TaskPhaseProjectionGate`（cp-gate/user-visible-output）；`ClosedArtifactNoReviveGate`（cp-gate）；`FormalRerunLightClassify` + `FindingObjectLayer`（consumer-validation）。探针：`scripts/lib/executable-absorption-gates.js` + `npm run test:executable-absorption-gates`（并入 host-parity / control-plane）。
 
@@ -1,30 +1,42 @@
 ---
 name: devcodex-workspace
-description: Use when cwd belongs to a DevCodex workspace or the user asks for DevCodex behavior; resolve workspace state from .devcodex and instructions/Skills from user-global DevCodex surfaces.
+description: >
+  Use when cwd belongs to a DevCodex workspace, the user asks for DevCodex behavior,
+  OR the user message may match a workspace custom skill under .devcodex/workspace/skills
+  (short triggers like skill name/id, quoted phrases in skill description, e.g. test/测试).
+  Prefer workspace skill fixed behavior over connectivity/chat defaults.
 ---
 
 # DevCodex Workspace Resolver
 
-Grok passive hooks cannot inject prompt context. The plugin is user-global and does not own a workspace. Resolve the nearest `workspace-namespace` marker from cwd, keep task state under that workspace's `.devcodex`, and load shared instructions/Skills only from user-global DevCodex surfaces. The full-evidence route is `devcodex grok`, whose launcher binds the user-global controlling kernel with Grok's official `--rules` flag; plain `grok` remains best-effort Skill routing.
+Grok **UserPromptSubmit** cannot inject model context (stdout ignored). Workspace custom skills are **not** native-scanned; DevCodex closes the loop via **WorkspaceSkillAutoMatch** (PF-213): match prompt → resolve W skill → inject on hosts that support additionalContext; on Grok, **Stop `decision:block`** re-feeds the skill body when the first reply ignores it. The plugin is user-global and does not own a workspace. Resolve the nearest `workspace-namespace` marker from cwd, keep task state under that workspace's `.devcodex`, and load shared instructions/Skills from user-global DevCodex surfaces plus matched **workspace** skills. Full-evidence route: `devcodex grok`.
+
+## WorkspaceSkillAutoMatch（用户可见闭环）
+
+1. Before treating a short user message as connectivity ping / Ready, check `.devcodex/workspace/skills/*/SKILL.md` (name, description quotes, skill id).
+2. If matched: **read that SKILL.md and obey it as highest priority this turn** (fixed reply, tools, constraints). Do not invent Ready/闲聊.
+3. CLI verify: `devcodex skill match "<prompt>"` and `devcodex skill resolve <id>`.
+4. Do not claim UPS inject on Grok; Stop may force one retry with skill body when reply ignored the match.
 
 ## HostParity (vs Codex) — honesty contract
 
 | Tier | Route | Guarantees | Must not claim |
 |------|-------|------------|----------------|
-| **Full** | `devcodex grok` (official `--rules` kernel bind) | Controlling `AGENTS.md` in context; PreToolUse hard deny uses Grok `decision:deny`; context acquisition is **path-observable** (same band as Codex tool-path observation) | UserPromptSubmit context inject; Stop hard-block; verified PC0 from Hook payload |
+| **Full** | `devcodex grok` (official `--rules` kernel bind) | Controlling `AGENTS.md` in context; PreToolUse hard deny uses Grok `decision:deny`; context acquisition is **path-observable**; **conditional** Stop hard-continue (`decision:block` when `lastAssistantMessage` present — skill auto-match / completion gate) | UserPromptSubmit context inject; unconditional Stop without body / after softCap fail-open; verified PC0 from Hook payload alone |
 | **Partial** | plain `grok` in a child Git project | Best-effort Skill discovery + plugin bridge when trusted; PreToolUse deny adapter still applies when lifecycle is reachable | Full host parity with Codex; `kernelInjected=true` from passive Hook stdout |
 
-Platform facts (Grok Build hooks docs): only `PreToolUse` is blocking; passive event stdout is ignored for model context. PC5 must report `Partial` unless Full launcher evidence is present. Do not equate Grok with Codex `hook-enforced` bootstrap.
+Platform facts (Grok Build hooks docs): `PreToolUse` and `Stop`/`SubagentStop` can hard-control; UserPromptSubmit is passive (no inject). PC5 must report `Partial` unless Full launcher evidence is present. Do not equate Grok with Codex UPS inject bootstrap.
 
 1. Preserve the semantic intent seed before reading project context.
 2. Bind the nearest valid `workspace-namespace` root from cwd. Do not require or create workspace `AGENTS.md`, `.agents`, `.grok`, `.codex`, `.claude`, `.gemini`, or `.github`.
 3. Resolve the project namespace relative to that workspace and bind runtime state under `.devcodex/<project>/`.
-4. Follow the kernel's intent-first route and read only selected files from `~/.agents/skills/` plus the resulting workspace Profile/context plan.
+4. Follow the kernel's intent-first route and read only selected files from `~/.agents/skills/` plus the resulting workspace Profile/context plan, **and any WorkspaceSkillAutoMatch hit under `.devcodex/workspace/skills/`**.
 5. Use `~/.agents/devcodex/instructions.full.md` only for an explicit fallback; workspace `.devcodex` remains the sole workspace-owned DevCodex surface.
 6. Before substantive output, satisfy the parent kernel's visible entry-check (PC0~PC7). Runtime cannot inject that block on Grok; models still own S07 user-visible output.
 7. Optional assist: call MCP `profile_compose_entry_check` to obtain a portable PC0~PC7 block, or rely on PreToolUse deny reasons that embed the same template when context acquisition is incomplete.
 8. Run `devcodex doctor` / `devcodex status` and read `hostParity` (`HostParityScorecardV1`): `full-capable` means hard path is ready; still use `devcodex grok` for Full session kernel evidence. `partial` lists **failedChecks** and **executable repairSteps** (commands); re-run doctor after each fix.
 9. Execute **GrokTurnChecklist** every non-trivial turn (PF-165 + C16/PI-20260724-01): PC0~PC7 → Intent→Skill mandatory bundle → ContextReadPlan → **scan-hygiene** → **TTFV first delivery** → work/gates → report+memory → honest platform ceiling. Never skip S05/S07/C17 because inject is missing.
+10. **Workspace skill trigger**: if user message matches a W skill, obey that skill before checklist bulk for chat-like turns.
 
 ## GrokTurnChecklist + Intent→Skill bundle (PF-165)
 
@@ -38,7 +50,7 @@ Platform facts (Grok Build hooks docs): only `PreToolUse` is blocking; passive e
 | ttfv-first-delivery | **TimeToFirstValueGate**: same user-visible turn delivers scope card OR first findings/conclusion OR hard block (non-chat) |
 | work-and-gates | CP/ECR as applicable |
 | report-memory | Non-chat write report + memory |
-| honest-ceiling | No inject / Stop hard-block / Grok===Codex claims |
+| honest-ceiling | No inject / unconditional Stop hard-block / Grok===Codex claims; Stop is conditional (body + softCap) |
 
 Machine source: `scripts/lib/host-parity-scorecard.js` (`GROK_TURN_EXECUTION_CHECKLIST`, `classifyWorkspaceRootScanSample`, `classifyTtfvOmissionSample`, `repairSteps`). Site doc: `website/docs/intro/host-parity-grok.md`.
 
 
@@ -94,6 +94,16 @@ function buildLifecycleHookOutput({ env, enforcementMode }) {
       if (['stop', 'agentstop', 'subagentstop'].includes(event)) return { decision: 'block', reason: message }
       return { continue: true, systemMessage: message }
     }
+    if (platform === 'grok') {
+      if (event === 'pretooluse' || event === 'permissionrequest') {
+        return { decision: 'deny', reason: message }
+      }
+      // Official Grok Stop Decision Control: decision:block + reason fed back to the model.
+      if (['stop', 'subagentstop', 'agentstop'].includes(event)) {
+        return { decision: 'block', reason: message }
+      }
+      return { continue: true, systemMessage: message }
+    }
     return toolBlockOutput(eventName, reason, detail)
   }
 
@@ -131,9 +141,11 @@ function buildLifecycleHookOutput({ env, enforcementMode }) {
     if (platform === 'copilot') {
       return ['pretooluse', 'stop', 'agentstop', 'subagentstop'].includes(event)
     }
-    // Grok Build: only PreToolUse is blocking; all other lifecycle events are passive
-    // (stdout ignored). Never advertise UserPromptSubmit/Stop hard-block parity with Codex.
-    if (platform === 'grok') return event === 'pretooluse' || event === 'permissionrequest'
+    // Grok Build: PreToolUse deny + Stop/SubagentStop block (official Stop Decision Control).
+    // UserPromptSubmit remains non-hard for inject; UPS inject still not claimed.
+    if (platform === 'grok') {
+      return ['pretooluse', 'permissionrequest', 'stop', 'subagentstop', 'agentstop'].includes(event)
+    }
     return ['pretooluse', 'permissionrequest'].includes(event)
   }
 
 
@@ -152,11 +152,10 @@ function isGrokImportedClaudePayload(host, payload, originalEvent) {
 }
 
 /**
- * Grok Build official PreToolUse contract:
- *   allow → { "decision": "allow" }
- *   deny  → { "decision": "deny", "reason": "..." }
- * PassivePassive events ignore stdout; never emit blocking decisions there.
- * @see ~/.grok/docs/user-guide/10-hooks.md
+ * Grok Build official contracts (see ~/.grok/docs/user-guide/10-hooks.md):
+ *   PreToolUse allow/deny → { "decision": "allow"|"deny", "reason"? }
+ *   Stop/SubagentStop block → { "decision": "block", "reason": "..." } (fed back to model)
+ * UserPromptSubmit / other non-tool events: do not claim context inject; strip hard deny there.
  */
 function adaptGrokOutput(originalEvent, output) {
   const value = output && typeof output === 'object' && !Array.isArray(output) ? { ...output } : { continue: true }
@@ -166,6 +165,7 @@ function adaptGrokOutput(originalEvent, output) {
 
   const event = normalizeEventToken(originalEvent)
   const isPreTool = event === 'pretooluse'
+  const isStop = event === 'stop' || event === 'subagentstop' || event === 'agentstop'
   const permission = value.hookSpecificOutput?.permissionDecision
   const reason = value.reason
     || value.hookSpecificOutput?.permissionDecisionReason
@@ -188,15 +188,34 @@ function adaptGrokOutput(originalEvent, output) {
     return value
   }
 
-  // PassivePassive events (UserPromptSubmit, Stop, PreCompact, …): stdout is ignored for model
-  // context. Strip hard-block decisions so we never pretend inject/block worked.
+  // Stop Decision Control: preserve block so incomplete closure can force another turn.
+  if (isStop) {
+    if (value.decision === 'block' || value.decision === 'deny') {
+      return Object.freeze({
+        decision: 'block',
+        reason: String(reason || 'DevCodex requires another agent turn.'),
+        devcodexGrokEvidenceMode: 'stop-decision-block'
+      })
+    }
+    if (value.decision === 'allow') {
+      return Object.freeze({ decision: 'allow', devcodexGrokEvidenceMode: 'stop-decision-allow' })
+    }
+    // Soft reminder only
+    const soft = { continue: true, devcodexGrokEvidenceMode: 'stop-soft' }
+    if (value.systemMessage) soft.systemMessage = value.systemMessage
+    if (value.hookSpecificOutput && typeof value.hookSpecificOutput === 'object') {
+      soft.hookSpecificOutput = { ...value.hookSpecificOutput }
+    }
+    return Object.freeze(soft)
+  }
+
+  // Other non-tool events: do not claim UPS inject / hard-block parity.
   const next = { ...value, continue: true }
   delete next.decision
   if (next.hookSpecificOutput && typeof next.hookSpecificOutput === 'object') {
     const hso = { ...next.hookSpecificOutput }
     delete hso.permissionDecision
     delete hso.permissionDecisionReason
-    // Keep systemMessage/additionalContext only as possible UI annotations; do not claim injection.
     next.hookSpecificOutput = hso
     next.devcodexGrokEvidenceMode = 'passive-hook-no-context-injection'
   } else {