feat(hooks): Dim 9 residuals 1/2 — prompt evaluator prod wiring + 6 newly-live hook events

[sweetcornna]

Summary

Closes the bulk of the verified-open Dim 9 gaps (audit/GAP_CLOSE_2026-07-08.md B1/B2/B3).

B1 — prompt-kind production evaluator

v1.25.0 shipped prompt/agent hook kinds but both HookRunner construction sites passed only rule_matcher → those kinds silently failed open (_exec_evaluator's unwired: warn-once). New hooks_evaluators.py:

• single-shot LLM judge — hook prompt = judging instruction, event payload = evidence (8KB cap), answer = the {"ok", "reason"} verdict shape the engine already coerces;
• wired at both sites (main._build_hook_runner + c2_wiring), each resolving its provider lazily per fire (hot-reload picked up; independent of provider-bootstrap ordering);
• judge model precedence: hooks.evaluator_model > CORLINMAN_HOOK_EVAL_MODEL > models.default;
• reasoning deltas never count as verdict text; unparseable / no-model keeps today's fail-open.
• agent-kind: register_hook_agent_runner late-binding seam + verdict parsing land now; production registration remains a ledgered residual (needs an out-of-turn subagent entry point — same blocker as the Dim 7 items).

B2/B3 — six accepted-but-dormant events gain live emitters

event	emit site	semantics
pre_compact	reasoning loop, gated on the same elide threshold _compact_history applies	blocking — deny defers budget-path compaction one round; overflow shrink stays unconditional (a hook can delay, never brick)
session_start	servicer chat entry	once per session_key per process (bounded seen-set)
session_reset	console /new + /clear	advisory
notification	ask_user (needs_input) + subagent terminal states (new dispatcher hook_notifier seam)	advisory — claude-code "needs input / task completed"
file_changed	after post_tool for write_file/edit_file/notebook_edit	advisory, payload carries path
setup	gateway lifespan boot-complete + embedded brain assembly	once per process

hooks_live.LIVE_HOOK_EVENTS + /hooks & admin live/dormant labels updated — only session_end remains dormant. One stale test assertion (session_start listed as dormant) updated accordingly; that behavior change is this PR's point.

Tests

7 evaluator (incl. end-to-end deny through HookRunner) · 3 pre_compact loop · 6 emit-site · session_start once-per-key drive-through · 2 console session_reset. Affected suites 640+ green; ruff / mypy / lint-imports green.

Notes

• Part 2/2 (async exit-2 rewake + stream-json hook lines) follows separately — both are plumbing-heavy with their own review surface.
• CHANGELOG/version bump (1.29.0) will trivially conflict with the other in-flight wave PRs (fix(security): W8 multi-tenant session isolation (critical, hunt-51) #114/feat(mcp): Dim 5 leftovers 1/2 — sampling completer prod wiring + /mcp command + embedded MCP plane #115/feat(mcp): Dim 5 leftovers 2/2 — .mcp.json layered scopes + client resources #116); whichever merges later rebases the version line.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ca75b7c81d

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Gate file_changed on successful writes

For write_file, edit_file, and notebook_edit, this branch runs after every tool result, including args_invalid, permission_denied, workspace_escape, or write_failed envelopes returned by _dispatch_builtin_inner. In those cases no workspace file changed, but formatter/sync hooks still receive file_changed with the requested path, so operators can run side effects against stale or nonexistent files; parse the result or otherwise only emit this event after a successful mutation.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Resolve hook evaluator aliases from the live config

This prompt evaluator closes over _models_cfg from gateway startup, while the config watcher hot-reloads providers/models by replacing state.provider_registry/state.config and only calls HookRunner.reload() for hook definitions. After /admin/config/reload changes [models].aliases, models.default, or hooks.evaluator_model, prompt-kind hooks continue resolving the judge model with the boot-time alias/default until a restart, even though the rest of the provider stack has been hot-swapped.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Pass tool_name to file_changed hooks

When operators configure a declarative FileChanged group with matcher = "write_file" or edit_file, it never matches this event because HookRunner.run_event_async() derives the declarative matcher input from payload["tool_name"], while this payload only sets tool. The hook still fires for wildcard matchers, but tool-specific file_changed hooks are silently skipped; include tool_name (or adjust the runner) so the new event can be filtered by the mutating tool that caused it.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.