feat(stage7b): dual-target hook engine (shared logic core + CC hooks + opencode plugin)

[thomasluizon]

Stage 7b — dual-target hook engine

Enforceable invariants written once, tool-neutrally, and enforced in both Claude Code and opencode off a single shared logic core. No SDLC policy is a constant anywhere in the engine; it all comes from hooks.policy.json at runtime, which is why the extended genericity gate can guarantee zero leakage. Design per harness-upgrade-plan.md Stage 7 (checklist 7b; sections B + F). Locked design, implemented.

Stacked on chore/stage7a-purge-codex-refresh-core (PR #1, still open). Base is that branch so the diff is 7b-only; retarget to main once 7a merges.

Shared logic core — core/hooks/logic/ (pure, dependency-free)

• git-action evaluateGitCommand(command, policy, ctx) — protected-ref push (explicit + bare-on-protected via an injected branch resolver), the git bypass flags, no-gpg-sign, branch-name pattern (+ exceptions), ticket ref, forbidden trailers, large-binary add. Every literal is a policy field; none is baked in.
• content-scan scanContent + checkLargeBinary — em dash (numeric en-dash allowed), banned phrases, secrets (conservative universal set + project extras), each rule independently path-scoped.
• proactivity — reminder line + judge-prompt builder + verdict parser + transcript-turn slicer + skill-digest loader.
• payload — normalize a Claude Code OR opencode payload into one neutral record.
• scope — dependency-free glob→RegExp (**, *, ?, {a,b}) + scope/exception match.
• config loadPolicy — DEFAULT_POLICY < global < project, JSON only (no YAML at runtime).

Template library — core/hooks/templates.mjs

11 parameterized invariants with config bindings, defaults, path-scope/exception support, and a gateTable() for the later decomposition gate.

Two thin adapters off the one core

• adapters/claude-code/hooks/ — git-guardrails, content-guard, proactivity-reminder (UserPromptSubmit), proactivity-guard (Stop, model-configurable) + a settings.hooks.json wiring snippet. stdin → logic → exit 2 / block.
• adapters/opencode/plugin/agentic-harness.js — tool.execute.before → throw (full enforcement parity); event/session.idle guard (best-effort — opencode cannot rewind a finished turn). Core resolved via the runtime project directory (bundling-proof) with import.meta.url fallbacks. opencode plugin API verified against the live @opencode-ai/plugin SDK (.opencode/plugin/ singular; tool.execute.before(input, output); block by throw; event → session.idle).

Strongest-layer generators — core/hooks/lint-generators/

detect + eslint/roslyn/ruff generators + strongestLayerFor() routing a code-level policy to a real linter rule where the stack supports it; the content-scan hook is the fallback only where no linter can express it.

Folded in (deferred from 7a)

adapters/claude-code/workflows/audit.mjs — the genericized Workflow-audit accelerator. All repos/surfaces/ladders/checklists arrive via args (Workflow scripts have no fs/Node access), zero project constants.

Wiring

• check-genericity.mjs now also scans the authored engine adapters.
• gen-adapters.mjs scopes its wipe to skills/+agents/ so the authored engine dirs survive regeneration.
• install.mjs vendors the engine dirs beside the vendored core.
• CI runs genericity + the hook-engine proof + an adapters-in-sync check.
• .gitattributes (LF), hooks.policy.example.json, a hooks: block in the config example, and core/hooks/README.md document the surface.

Proof — scripts/test-hook-engine.mjs (CI-gated, 42 assertions)

Vendors the pack into a temp project and runs the real CC hook and the real opencode plugin: a push to a protected branch is blocked by both, a feature-branch push allowed by both, an em dash caught by both — the dual-target wiring proven end to end over one logic core. This starts 7h; the paired Orbit .opencode/plugin port lands as a separate cross-linked orbit-ui-mobile PR.

🤖 Generated with Claude Code

[thomasluizon]

Paired Orbit deliverable (7h) landed as thomasluizon/orbit-ui-mobile#441 — ports Orbit's CC hooks to .opencode/plugin/ via the same shared-logic-core + adapter pattern proven here.