Retire Taskdeck-owned runtime hooks

[Chris0Jeky]

Summary

• retire Taskdeck-owned Claude runtime hooks, pre-commit handlers, and the incomplete local command deny list
• retain normal development permissions, the manual failure-ledger renderer/tests, guarded worktree bootstrap, and the repo's declared T3 push/merge authority
• align canonical status, delivery history, testing/worktree guidance, skill packs, parity docs, and the append-only failure ledger with the retired posture

Why

The project layer duplicated the global PreToolUse dispatcher, added a Python process to Bash calls, denied six of eight benign raw-text probes, did not cover native PowerShell, and could turn timeout-shaped tool noise into durable failure rows. Removing the project-owned runtime layer makes normal development smoother without claiming that user-, organization-, or runtime-level controls are disabled.

Reusable producer work is tracked in agent-harness issues #188, #189, #190, and #191.

Verification

• powershell -NoProfile -File scripts/git/Test-New-CodexIssueWorktree.ps1 ? 28/28 passed on the implementation parent; exact-head focused re-proof below covers the review fix
• powershell -NoProfile -File scripts/git/Test-New-CodexIssueWorktree.ps1 -Case headless-permission-contract ? 1/1 passed on exact head
• py -3 -B -m unittest discover -s scripts/agent_hooks -p "test_render_failure_ledger.py" ? 11/11 passed on exact head
• node scripts/check-docs-governance.mjs ? passed
• node scripts/check-golden-principles.mjs ? passed
• node scripts/check-github-ops-governance.mjs ? passed
• structural assertions confirm .claude/settings.json has no hooks or deny property, retired handler files are absent, and T3/free authority remains
• append-only history assertion confirms the original agent/powershell-deny-floor row is byte-preserved and a separate resolution row is appended
• deleted-handler reference sweep and git diff --check ? passed

No product runtime code changed, so backend/frontend builds and product tests were not run locally; Required CI remains the exact-head cross-platform gate.

Closes #1552
Closes #1293
Closes #1475
Closes #1476
Closes #1497

[Chris0Jeky]

Exact-head review packet

• Base: 076f10f7e6b34ddb9e9e44adb520d498e79888bf
• Head: 59199d49ced0f9f66e519f8f2ec46bb8e0db0f72
• Local proof through implementation head c587dae7: worktree helper 28/28 on its implementation parent; permission contract 1/1; ledger renderer 11/11; docs governance, golden-principles, GitHub-ops governance, structural retirement assertions, append-only history assertion, deleted-handler reference sweep, and git diff --check pass.
• Fresh correctness and security reviews at c587dae7 initially found two HIGH blockers, then confirmed both fixed: existing ledger history is byte-preserved with a separate resolution append, and permission guidance names the complete effective rule set.
• Automatic exact-head review then found one stale STATUS.md current-state sentence about deleted hooks. 59199d49 marks that dated entry historical and names Retire Taskdeck-owned runtime hooks while retaining T3 authority #1552 as its superseding posture. The thread is replied to/resolved; exact-head docs governance, golden-principles, GitHub-ops governance, stale-claim assertion, and diff check pass. This fix changes no logic or risk boundary, so the bounded pipeline does not require another independent review round.
• Product builds/tests were not run locally because no backend/frontend runtime code changed; the exact-head Required workflow is the cross-platform gate.
• Compatibility/docs: normal development permissions, guarded worktree bootstrap, T3 push/merge authority, stable product behavior, and HTTP contracts are unchanged. STATUS.md records current shipped posture; IMPLEMENTATION_MASTERPLAN.md records delivery history.
• External layers: this removes Taskdeck-owned hooks only. User-, organization-, managed-policy-, and runtime-level controls are explicitly not claimed as disabled.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c587dae77a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".