merge: v2.8.0 — Hardening + Structural Anti-Anchoring (2 reproduced scope-gate exploits, contract hardening, hook backstop, codex xhigh; 5-line audit + plan review + 5 Codex build rounds)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: copeus

.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
     {
       "name": "superpowers-v",
       "description": "Compound V for Superpowers: triple parallel pre-flight (code archaeology + domain-expert + Context7 library validator), disjoint partitioning, manifest-driven multi-backend dispatch (Claude + Codex + Antigravity + Cursor), git-diff scope enforcement, crash-resumable runs, adaptive tier-based routing, epic mode, research-grounded brainstorming (gated pre-brainstorm recon + batched elicitation), V-memory local-first semantic+lexical recall over docs/superpowers (opt-in pure-python embeddings + a deterministic recall→action bridge), and batched parallel dispatch (Opus default, narrow Sonnet exception)",
-      "version": "2.7.0",
+      "version": "2.8.0",
       "source": "./",
       "author": {
         "name": "Oleg",

.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "superpowers-v",
   "description": "Compound V for Superpowers: triple parallel pre-flight (code archaeology + domain-expert advisor + library/doc validator via Context7), disjoint file partitioning, manifest-driven multi-backend dispatch (Claude + headless Codex + Antigravity + Cursor workers), git-diff scope enforcement, crash-resumable runs, adaptive tier-based routing, epic mode for multi-feature builds, V-memory local-first semantic+lexical recall over docs/superpowers (opt-in pure-python embeddings + a deterministic recall\u2192action bridge), and batched parallel dispatch (Opus default, Sonnet for narrow junior-task carve-out), plus /v:onboard — a project-onboarding command that builds a citation-verified knowledge base + AGENTS.md/CLAUDE.md bridge behind a human gate. Auto-intercepts four transitions: pre-brainstorm recon \u2192 brainstorming \u2192 writing-plans \u2192 execution.",
-  "version": "2.7.0",
+  "version": "2.8.0",
   "author": {
     "name": "Oleg",
     "email": "copeus@gmail.com"

AGENTS.md

@@ -6,7 +6,7 @@ This file documents how the plugin's content *would* be consumed by tools that r
 
 Compound V is a **sidekick to Superpowers**. It intercepts the four Superpowers phase transitions (pre-brainstorm recon → brainstorming → writing-plans → execution) and adds:
 
-0. **Gated pre-brainstorm recon (Trigger 0)** 🧪 description-driven, **zero hook backstop** (it fires before any file exists, so no hook can reinforce it — weaker than the other three interception points): before a brainstorm begins on an unfamiliar topic, a gated, bounded research pass (bundled `deep-research` if present, ≤6 parallel WebSearch otherwise, skip-with-notice if neither) writes an anti-anchoring recon doc to `docs/superpowers/recon/` that the brainstorm — and later pre-flights 1B/1C — read first. Gate order: plumbing-skip → V-memory KB hit → `brainstorm.deep_research` config (`ask` default / `auto` / `off` hard kill-switch). Recon is evidence, never a routing input. Also 🧪 description-driven: **batched elicitation** — ≥3 *independent* clarifying questions may batch into one Visual Companion form screen (dependent chains stay sequential; when unsure → sequential); see `skills/compound-v/brainstorm-elicitation.md`.
+0. **Gated pre-brainstorm recon (Trigger 0)** 🧪 description-driven, with a **reminder-only hook backstop** (v2.8: `hooks/brainstorm-trigger0-nudge.sh` nudges when the Skill tool invokes `superpowers:brainstorming` — a reminder, not enforcement; nothing can force the recon to run): before a brainstorm begins on an unfamiliar topic, a gated, bounded research pass (bundled `deep-research` if present, 3–6 parallel WebSearch otherwise, skip-with-notice if neither) writes an anti-anchoring recon doc to `docs/superpowers/recon/` that the brainstorm — and later pre-flights 1B/1C — read first. Gate order: plumbing-skip → V-memory KB hit → `brainstorm.deep_research` config (`ask` default / `auto` / `off` hard kill-switch). Recon is evidence, never a routing input. Also 🧪 description-driven: **batched elicitation** — ≥3 *independent* clarifying questions may batch into ONE screen via the surface ladder — Visual Companion form if accepted this session, else the harness's structured-question tool, else sequential (companion acceptance gates only the top surface); dependent chains stay sequential; when unsure → sequential; see `skills/compound-v/brainstorm-elicitation.md`.
 1. **Three parallel pre-flights** after brainstorming:
    - Code archaeology (existing-code reality)
    - Domain-expert advisor with three-layer audience search (product/regulatory reality)
@@ -22,15 +22,15 @@ The execution tail is a small, deterministic orchestrator — contracts + helper
 
 - **Manifest contract:** `skills/compound-v/execution-manifest.md` (schema) + `examples/manifest.example.yaml`.
 - **Backend Launcher sub-skill:** `skills/backend-launcher/SKILL.md` defines one `job_spec → job_result` contract (`schemas/job_result.schema.json`). Adapters: `adapter-claude.md`, `adapter-codex.md`, `adapter-antigravity.md` (1.1: a **real** headless `agy --print` worker — same worktree + `git diff` scope gate as Codex, but **opt-in / lower-trust**: `agy` has no kernel write-confinement, so the gate *detects* in-worktree scope leaks yet cannot *prevent* an out-of-worktree side-effect — **prefer Codex for untrusted work**), and `adapter-cursor.md` (2.1: a headless `cursor-agent -p -f` worker, verified live, same worktree + scope gate — also opt-in / lower-trust, same caveat as Antigravity; needs an authenticated `cursor-agent`).
-- **Headless Codex worker:** `scripts/compound-v-run-codex-worker.sh`. The verified `codex-cli 0.130` invocation runs in a git worktree:
+- **Headless Codex worker:** `scripts/compound-v-run-codex-worker.sh`. The verified `codex-cli 0.144.1` invocation runs in a git worktree:
 
   ```bash
   codex exec --cd "$WT" --sandbox workspace-write --skip-git-repo-check \
     --model "$model" --output-last-message "$WT/.job_result.txt" \
     -c sandbox_workspace_write.network_access=false "$prompt"
   ```
 
-  Do **not** pass `--ask-for-approval never` — it is invalid for `codex exec` (top-level/interactive flag only); `exec` already defaults to `approval: never`. Resume is `codex exec resume <uuid>`.
+  Do **not** pass `--ask-for-approval never` — it is invalid for `codex exec` (top-level/interactive flag only); `exec` already defaults to `approval: never`. Resume is `codex exec resume <uuid>`. Effort `xhigh` is **codex-only** (kernel `model_reasoning_effort`); every other backend rejects it — use `high` elsewhere.
 - **Scope gate:** `scripts/compound-v-scope-check.py` unions `git diff --name-only HEAD` with `git ls-files --others --exclude-standard` and tests each path against `write_allowed`.
 - **State + resume:** `skills/compound-v/state-machine.md`; `/v:resume <run-id>` re-dispatches only incomplete jobs (git-wins tie-break).
 
@@ -84,6 +84,8 @@ All reviewers/agents carry `model: opus`. Manifest `backend`/`model` values (`gp
 | `/v:archaeology <topic>` | (unchanged) Phase 1A only |
 | `/v:remember <query>` | Recall search over `docs/superpowers/**` prose (V-memory) — evidence for planning + review, not a routing input |
 | `/v:memory-refresh` | (Re)index the FTS5 recall lane; `--bootstrap` provisions the opt-in dense embeddings venv |
+| `/v:onboard` | Scan the repo and build a trusted, citation-verified knowledge base (`docs/superpowers/architecture/*`) plus an `AGENTS.md`/`CLAUDE.md` bridge, behind a human approval gate; `--refresh` re-checks staleness |
+| `/v:pr-review [url\|number]` | Deep two-axis (Standards ⊥ Spec) code review of a PR/MR or local diff — review-only, never edits; GitHub (`gh`), GitLab (`glab`), or a hostless local branch |
 
 ## Model policy (universal)
 

CHANGELOG.md

@@ -4,6 +4,34 @@ All notable changes to **superpowers-v (Compound V)** are documented here.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project uses semantic versioning.
 
+## [2.8.0] — 2026-07-11
+
+### Security — two scope-gate exploits, both reproduced before fixing
+
+- **Rename bypass (HIGH).** The gate's diff ran with git's default rename detection ON, so `git mv docs/important.md src/renamed.md` under `write_allowed: [src/**]` collapsed to a single record whose `--name-only` output was just the destination — the out-of-scope deletion of `docs/important.md` was invisible and the verdict was **pass** (reproduced). The diff argv now carries `--no-renames`: both sides of a rename surface as a delete + an add, and the out-of-scope source path BLOCKS. (`scripts/compound-v-scope-check.py`)
+- **Symlink escape (MEDIUM).** The gate string-matched changed paths and never `lstat`-ed anything — a symlink inside the allowed area pointing outside the worktree glob-matched cleanly, and a write through it landed OUTSIDE the repo with verdict **pass** (reproduced). The verdict path now scans the WHOLE gate root (`os.walk` with `followlinks=False`, symlinks only — cheap) and reports every symlink whose `realpath` escapes the root as a violation `"<path> (symlink escapes the worktree)"` — unconditionally: even inside the allowed area, and even for a **pre-existing** link committed before the baseline with no new changes at all, because a write through either lands where git sees nothing and the link itself is the only reliable gate-time signal. Degrade-safe on unreadable entries. **Honesty note (in the module docstring too):** the gate DETECTS the channel; it cannot observe writes already made through it — kernel-level confinement (the codex backend's sandbox) remains the preventive layer.
+- **Three new selftest cases** — rename-out-of-scope, job-created escaping symlink, pre-existing (committed-before-baseline) escaping symlink — each verified to FAIL against the unfixed logic via a temporary revert and PASS after the fix; the suite is green.
+
+### Added
+- **Trigger-0 hook backstop** (`hooks/brainstorm-trigger0-nudge.sh`, registered in `hooks/hooks.json`): when the Skill tool invokes `superpowers:brainstorming`, a one-line idempotent reminder to run the Trigger 0 gates is injected. A reminder, not enforcement — Trigger 0 stays description-driven; the hook closes the "agent simply forgets" gap documented in v2.7.0.
+- **`xhigh` effort — codex-only.** codex-cli live-accepts `model_reasoning_effort=xhigh` (probed 2026-07-11 on 0.144.1); the effort vocabulary gains `xhigh` valid **iff** `backend: codex` — every other backend rejects with a clear error naming the rule. Enforced in lockstep at `compound-v-resolve-model.py`, `compound-v-validate-manifest.py`, both codex shell workers, and stated identically on every active effort-vocabulary surface.
+- **Directions-late protocol (anti-anchoring, made explicit):** the brainstorm forms its own first-principles proposals BEFORE reading the recon doc's `## SUGGESTED DIRECTIONS`; consumption is observable via the recon-outcomes stream.
+- **recon-outcomes stream** (`docs/superpowers/memory/recon-outcomes.jsonl`): an append-only event machine — a gate-stopped Trigger-0 evaluation emits exactly one terminal event (`plumbing_skip|kb_skip|off|declined|no_engine`); an engine run emits `fired` → `saved` (with `path`) → `consumed` as three separate appended events, never a mutated line. Never read by routing.
+- **VERIFIED / UNVERIFIED split in recon docs:** the output contract is now genuinely five verbatim sections (`## QUESTIONS TO ASK`, `## VERIFIED FACTS / CONSTRAINTS`, `## UNVERIFIED LEADS`, `## SUGGESTED DIRECTIONS`, `## SOURCES`). VERIFIED = checked against a cited primary source (provisionally binding; 1B/1C revalidate); everything else is an UNVERIFIED LEAD that must become a question until validated.
+- **Gate-2 freshness rule:** a strong KB hit now requires scope AND freshness — volatile material (libraries, APIs, regulations, availability, best practices) older than ~30 days degrades to partial: still evidence, no longer skip-authority.
+
+### Fixed
+- **Recon wiring finally reaches the executing 1B/1C:** the recon-read step existed only in the phase docs — `agents/domain-expert.md`, `agents/doc-validator.md`, and both prompt templates never mentioned it, so dispatched pre-flights never learned a recon doc existed. All four now carry the read step plus the exact-path handoff contract.
+- **Epistemic contradiction in the gate-3 offer:** the "verbatim" copy promised deep-research even on machines without it, conflicting with the honesty rule one section down — the offer is now engine-aware and honest, and decline paths are reachable.
+- **Fail-closed config, verbatim everywhere it's consumed:** missing file or key → documented defaults (`deep_research: "ask"`, `batch_elicitation: true`); malformed JSON, wrong type, or unknown value → warn once, then `deep_research=ask` and `batch_elicitation=false` for the session — an invalid value is never treated as `auto`.
+- **Staleness sweep:** `GEMINI.md` was entirely pre-v2.7 ("three transitions", Gemini 2.5, missing command rows) — refreshed to the four-transition reality; surviving `codex-cli 0.130` pins → 0.144.1 and cursor worker provenance comments 2025.09.12 → 2026.06.26.
+
+### Audit credit
+Five audit lines drove this release: **F1** (live dogfood of Trigger 0/elicitation — procedures actually executed), **F2** (cross-repo consistency/staleness sweep), **F3** (scripts robustness — both scope-gate exploits reproduced on scratch fixtures before any fix), from three parallel Fable agents; plus **C1/C2** — two independent max-effort **Codex gpt-5.6-sol passes at `xhigh`** (the v2.7.0 guidance red-teamed as executable instructions, 28 findings; design red-team, 9 findings + 5 proposals). Cross-model by construction, convergent findings independently confirmed across lines. The pre-dispatch Codex plan review (verdict `reject`, 7 findings, all accepted) reshaped the plan itself — including the whole-root pre-existing-symlink scan shipped above.
+
+### Post-build cross-model review (Codex gpt-5.6-sol @ `xhigh`, 5 rounds)
+The build was reviewed to convergence. Round 1 (9 findings, all accepted): a `.git`-named escaping symlink bypassed the scan; the outcomes event machine had no legal failure transition; the exact-path handoff had no literal storage carrier; five active surfaces still described batching as companion-only; the dedicated "max-effort" review command still capped at `high`. Rounds 2–5 hardened the symlink scan alone through four more genuine edges — a nested **real** `.git` directory hiding a link, a `chmod 000` directory, and finally a **real false-PASS** where `os.path.islink` silently swallows `EACCES` on a `0400` (readable-but-not-searchable) directory (fixed by switching to `os.lstat`, which raises). Each fix carries a selftest; the gate self-test suite is green.
+
 ## [2.7.0] — 2026-07-10
 
 ### Added

GEMINI.md

@@ -4,14 +4,15 @@ This file documents how the plugin's content *would* be used in Gemini CLI. **Th
 
 ## What this plugin does
 
-Compound V is a **sidekick to Superpowers**. It intercepts the three Superpowers phase transitions (brainstorming → writing-plans → execution) and adds:
+Compound V is a **sidekick to Superpowers**. It intercepts the four Superpowers phase transitions (pre-brainstorm recon → brainstorming → writing-plans → execution) and adds:
 
+0. **Gated pre-brainstorm recon (Trigger 0)** 🧪 description-driven, with a **reminder-only hook backstop** (`hooks/brainstorm-trigger0-nudge.sh`, a Claude Code hook that nudges when the Skill tool invokes `superpowers:brainstorming` — a reminder, not enforcement): before a brainstorm begins on an unfamiliar topic, a gated, bounded research pass (bundled `deep-research` if present, 3–6 parallel WebSearch otherwise, skip-with-notice if neither) writes an anti-anchoring recon doc to `docs/superpowers/recon/` that the brainstorm — and later pre-flights 1B/1C — read first. Gate order: plumbing-skip → V-memory KB hit → `brainstorm.deep_research` config (`ask` default / `auto` / `off` hard kill-switch). Recon is evidence, never a routing input. Also 🧪 description-driven: **batched elicitation** — ≥3 *independent* clarifying questions may batch into ONE screen via the surface ladder — Visual Companion form if accepted this session, else the harness's structured-question tool, else sequential (companion acceptance gates only the top surface); dependent chains stay sequential; when unsure → sequential; see `skills/compound-v/brainstorm-elicitation.md`.
 1. **Three parallel pre-flights** after brainstorming:
    - Code archaeology (existing-code reality)
    - Domain-expert advisor with three-layer audience search (product/regulatory reality)
    - Library/doc validator via Context7 MCP (dependency currency)
 2. **Disjoint File Partition Map enforcement** inside writing-plans, which **materializes a `manifest.yaml`** — the machine-readable contract that drives dispatch
-3. **Manifest-driven dispatch** on the most capable model available (Gemini 2.5 Pro or equivalent), with a **`git diff` scope gate after every job** (a worker that writes outside its `write_allowed` list is BLOCKED and never merges) and **crash-resume** via a `state.json` run directory
+3. **Manifest-driven dispatch** on the most capable model available (Gemini 3.1 Pro or equivalent), with a **`git diff` scope gate after every job** (a worker that writes outside its `write_allowed` list is BLOCKED and never merges) and **crash-resume** via a `state.json` run directory
 
 ## Orchestrator surface (v1.0 + 1.1)
 
@@ -45,8 +46,8 @@ Gemini's `activate_skill` tool can load the SKILL.md content on demand. Trigger:
 
 This plugin was authored for the Anthropic Claude family. On Gemini:
 
-- "Opus default" → **Gemini 2.5 Pro** (or whatever is currently the most capable model)
-- "Sonnet exception" → **Gemini 2.5 Flash** for the same narrow junior-task taxonomy
+- "Opus default" → **Gemini 3.1 Pro** (or whatever is currently the most capable model)
+- "Sonnet exception" → **Gemini 3.5 Flash** for the same narrow junior-task taxonomy
 - "Never Haiku" → Never use Gemini Flash-Lite or smaller; the project's reasoning bar is high
 
 See `skills/compound-v/phase-3-parallel-opus-dispatch.md` § "Model Selection Taxonomy" for the strict 8-box criteria that gate the cheaper-model carve-out, and `skills/compound-v/routing-policy.md` for the env-aware stances (Balanced / Conservative / Cost-aware). Reviewers are always the top-tier model; the cheaper-model carve-out never applies to a reviewer.
@@ -69,6 +70,8 @@ These are Claude Code `/v:*` commands. On Gemini CLI, invoke the equivalent skil
 | `/v:archaeology <topic>` | (unchanged) Phase 1A only |
 | `/v:remember <query>` | Recall search over `docs/superpowers/**` prose (V-memory) — evidence for planning + review, not a routing input |
 | `/v:memory-refresh` | (Re)index the FTS5 recall lane; `--bootstrap` provisions the opt-in dense embeddings venv |
+| `/v:onboard` | Scan the repo and build a trusted, citation-verified knowledge base (`docs/superpowers/architecture/*`) plus an `AGENTS.md`/`CLAUDE.md` bridge, behind a human approval gate; `--refresh` re-checks staleness |
+| `/v:pr-review [url\|number]` | Deep two-axis (Standards ⊥ Spec) code review of a PR/MR or local diff — review-only, never edits; GitHub (`gh`), GitLab (`glab`), or a hostless local branch |
 
 ## Key entry points