Compile semantic event route v2 families into native host hooks

[ScriptedAlchemy]

Summary

Follow-on tracker for the canonical event-route families promoted in the #97 documentation audit (#97 comment) after v1 landed. v1 delivered the four existing hook families plus agent/start/agent/stop, with workspace/open honestly unavailable on every pinned host (#221).

Each family below needs the same evidence bar v1 used: pinned per-host wire schema or official contract, decode fixture, matcher/deadline semantics, immediate-output projection through the Agent Document renderer, and an honest supported/degraded/unavailable/prohibited row in inspect — not inference from similarly named events.

Promote to canonical route families

• session/end — Claude, Codex, Cursor
• prompt/submit — Claude UserPromptSubmit, Codex UserPromptSubmit, Cursor beforeSubmitPrompt
• tool/failure — Claude PostToolUseFailure, Cursor postToolUseFailure; Codex unavailable at the release-documented surface
• compact/before — Claude/Codex PreCompact, Cursor preCompact
• compact/after — Claude/Codex PostCompact; Cursor unavailable
• permission/request — Claude/Codex PermissionRequest; do not infer Cursor support from pre-tool permission
• permission/denied — Claude PermissionDenied; other hosts unavailable until evidenced
• file/change (proposed file/saved) — Claude FileChanged, Cursor afterFileEdit; payload/matcher differences must stay visible
• config/change — Claude ConfigChange; other hosts unavailable
• task/create, task/complete, agent/idle — Claude TaskCreated, TaskCompleted, TeammateIdle; host-specific today
• stop/failure — Claude StopFailure; other hosts unavailable

Keep as selectors/native variants (not new families unless fixture evidence proves loss)

Cursor beforeShellExecution/afterShellExecution, beforeMCPExecution/afterMCPExecution, beforeReadFile, and afterFileEdit overlap canonical tool-before/tool-after plus tool selectors. Add dedicated families only if fixture evidence proves the generic tool route loses required information or control.

Explicitly defer/unavailable in capability tables

• Claude-only host/UI/protocol callbacks: Setup, UserPromptExpansion, PostToolBatch, MessageDisplay, InstructionsLoaded, CwdChanged, DirectoryAdded, PreModelSwitch, PostModelSwitch, Elicitation, ElicitationResult, WorktreeCreate, WorktreeRemove.
• Claude Notification belongs to Add recipient-aware notices and capability-gated delivery #99 delivery-channel evidence, not an application event route.
• Cursor afterAgentResponse, afterAgentThought, beforeTabFileRead, afterTabFileEdit stay native/deferred until a canonical consumer is accepted.
• Codex generated Interrupt stays deferred until release docs and a pinned CLI revision agree.
• Cloud/desktop availability differences are capability dimensions, not universal-support claims.

For every deferred item, add a dated unavailable/prohibited row with the native name and reason.

Depends on

• v1 event infrastructure: feat(events): define v1 semantic route descriptors #170, feat(events): publish host family capability states #173, feat(events): render native hooks through warm runtime #180, feat(examples): adopt semantic event route #182, fix(events): correct Claude and Codex subagent hooks #194, fix(cursor): honest workspace/open, real marketplace, three-host composite intersection #221
• Agent Document renderer + warm runtime: Build a real RSC Agent Document renderer with streaming semantics #96 (feat(runtime): MCP progress projector and warm-runtime proofs (#96) #175)
• Stack plan: meta-framework: execution plan and sequencing #107 G10 family expansion rule

Non-goals

• Re-litigating v1 four-event parity or the corrected agent/start/agent/stop matrix
• Claiming workspace/open support without a sessionless native-envelope fixture

[ScriptedAlchemy]

v2 wave — group 1 landed: session/end + prompt/submit (#351, merge 9b165ba)

Both families are canonical event routes compiled into native host hooks, with the G10 evidence bar:

Target	session/end	prompt/submit
Claude 2.1.250 (live 2.1.257)	SessionEnd, observe-only (docs: no decision control, JSON output discarded) — live capture pinned	UserPromptSubmit, deny (decision:block+reason) + additionalContext; no prompt-rewrite channel — live capture pinned
Codex 0.147.0	SessionEnd, observe-only (rust-v0.147.0 has session-end.command.input.schema.json and no output schema; byte-pinned) — live capture pinned	UserPromptSubmit per byte-pinned input+output schemas (block + additionalContext; reason const-checked) — live capture pinned
Cursor 2026-08-28	sessionEnd, observe-only; cloud honestly unavailable (docs: no editor-lifetime session boundary) recorded as an availability dimension	beforeSubmitPrompt, deny only (continue:false + user_message); no context channel — projection fails closed on context
plugin (claude∩codex∩cursor)	supported, host-resolved	supported, host-resolved
portable 1.0.0	unavailable (no hooks in Agent Plugins 1.0.0)	unavailable

Both families are route-only: they ship in a separate eventRouteOnlyHookEvents vocabulary, so no new config.hooks.* handler keys were added. Cursor live capture was blocked by missing authentication in the capture environment (dated evidence bullet records this); the pinned official contract is the evidence source there. Scrubbed native fixtures for Claude/Codex are checked in and replay through the #279 lifecycle machinery.

Next groups staged: tool/failure + compact/before + compact/after, then permissions + stop/failure, then file/change/config/change/task/*/agent/idle + the deferral rows.

[ScriptedAlchemy]

Stage 2 landed in #357 (merge 2119cee): tool/failure, compact/before, and compact/after promoted with per-host fixtures, projection semantics, and dated capability evidence (Codex tool/failure and Cursor compact/after honestly unavailable; live cursor-agent capture could not authenticate, so the pinned official contract is the recorded evidence source for the Cursor rows).

Stage 1 (#351) covered session/end + prompt/submit. Remaining checklist: permission/request, permission/denied, stop/failure, file/change, config/change, task/create/task/complete/agent/idle, plus the dated deferral rows for the explicitly-deferred native callbacks.

[ScriptedAlchemy]

Stage 3 landed in #358 (merge 8c541ad): permission/request (Claude + Codex via the pinned rust-v0.147.0 PermissionRequest contract, allow/deny decisions, reserved rewrite fails closed), permission/denied and stop/failure (Claude observation-only; retry signalling deliberately unprojected pending canonical vocabulary). Remaining checklist: file/change, config/change, task/create/task/complete/agent/idle, plus the dated deferral rows for the explicitly-deferred callbacks.

[ScriptedAlchemy]

Stage 4 landed in #359: file/change, config/change, task/create, task/complete, and agent/idle promoted as Claude-only families with their documented decision channels (block decisions for config/task-create, continue:false for agent/idle, fail-closed observation-only for file/change and task/complete whose upstream control is side-effect/exit-code-only). Codex/Cursor/portable carry dated unavailable rows; Cursor afterFileEdit recorded as a tool/after selector variant per the selector rule. Remaining on this tracker: the dated deferral rows for the explicitly-deferred native callbacks (Setup, UserPromptExpansion, PostToolBatch, MessageDisplay, InstructionsLoaded, CwdChanged, DirectoryAdded, Pre/PostModelSwitch, Elicitation(Result), WorktreeCreate/Remove, Cursor tab/thought natives, Codex Interrupt) — these are native events with no canonical family, so they need a home in the capability tables (e.g. a deferredNativeEvents section) rather than eventRoutes rows.