fix: CoalTipple v1.0.11 — vuln-hunt fixes (safety gate, language backstop, config honesty)

A comprehensive vulnerability hunt (4 parallel scanners + an adversarial work-review).
9 confirmed fixes + a plural false-negative caught at the commit-gate:

- resolveWorker: the never-down sensitive gate could be breached by a mis-cased / typo'd
  floor (indexOf -1 -> Math.max(-1,0)=0 collapsed a sensitive task to the cheapest tier);
  now case-normalized + fail-safe (an unrecognized floor returns null, never the floor).
- Non-English sensitive prompts lost the deterministic flag (English-only keywords): the
  Step-2 HARD GATE now names the model the sensitive-gate authority for non-English, and
  the conductor injects a generic non-Latin-script nudge.
- mode + per-domain disableRouting were documented but dead; now wired (the sensitive
  HARD GATE overrides mode).
- grade matcher over-matched (token->tokenizer) then under-matched: fixed via a stem (*)
  vs whole-word convention, with the common plurals (tokens/secrets/passwords/sessions/
  payments/deadlocks/mutexes) listed so a plural no longer escapes the never-down flag.
- modelTiers pin doc cheap -> low; project config now anchors at the git root (not cwd);
  strict validateRanking (rejects array/{}/missing-key/non-array/all-empty/complete-truthy);
  verify.mjs uses the shared stripJsonc; grade() degrades on null input.

110 tests, verify PASS.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: HetCreep

.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "coaltipple",
-  "version": "1.0.10",
+  "version": "1.0.11",
   "description": "CoalTipple — model/effort router for Claude Code. Delegates a task you CAN do but is large+cheap DOWN to a lower tier to save tokens; escalates a task beyond the current tier UP for quality. Two-knob routing (tier × effort, effort-before-tier), introspection-first model classification, a validity-gated ranking Lock that never routes on broken state, and git-optional damage control. Advise-only Phoenix-pure hook; the model performs the routing.",
   "author": { "name": "HetCreep" },
   "homepage": "https://github.com/TheColliery/CoalTipple",

CHANGELOG.md

@@ -2,6 +2,26 @@
 
 All notable changes to CoalTipple are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); versions follow SemVer (the canonical version lives in `.claude-plugin/plugin.json`).
 
+## [1.0.11] - 2026-06-18
+
+A comprehensive vulnerability hunt (4 parallel scanners + an adversarial work-review pass) — safety-gate, routing-correctness, config-honesty, and worldwide-language fixes.
+
+### Fixed
+
+- **The never-down sensitive gate could be breached by a mis-cased / typo'd floor.** `resolveWorker` (classify.mjs) matched `floorTier` case-sensitively, so `'Heavy'` or a typo fell through `indexOf → -1 → Math.max(-1,0) = 0` and collapsed a SENSITIVE task to the *cheapest* tier under a limit-hit. Now case-normalized + fail-safe: an unrecognized floor returns `null` (hand back), never the floor.
+- **Non-English sensitive prompts lost the deterministic safety flag.** The keyword grader + the conductor hint match English literals only, so a Thai/CJK/Arabic prompt meaning "scan for bugs" / "constant-time compare" fired no flag — the "keyword is the gate" backstop silently vanished. The Step-2 HARD GATE now states the model is the sensitive-gate authority for non-English (grade by MEANING), and the conductor injects a generic non-English nudge on non-Latin script. (The model layer has been multilingual since 1.0.9; this closes the *deterministic* backstop.)
+- **`mode` and per-domain `disableRouting` were documented but dead.** `mode:"off"` still routed; `disableRouting:["coding"]` did nothing. Both are now wired (SKILL + conductor): `mode` constrains direction (`auto`/`delegation`/`escalation`/`off`, the sensitive HARD GATE overriding it), and per-domain disable is honored.
+- **The grade keyword matcher over-matched, then a fix under-matched.** A missing trailing word-boundary let `token`→"tokenizer", `crypto`→"cryptocurrency" wrongly grade sensitive. Fixed with a stem (`*`) vs whole-word convention — and the common plurals (`tokens`/`secrets`/`passwords`/`sessions`/`payments`/`deadlocks`/`mutexes`) are now listed so a plural no longer escapes the never-down flag.
+- **The `modelTiers` pin doc named a non-existent tier.** The `--help`/schema text said `cheap` (silently dropped by `applyPins`); the real cheapest tier is `low`.
+- **Project config could be read from the wrong directory.** `config-load.mjs` resolved from `process.cwd()` while the conductor + configure used the git root — a subdir cwd read a different file. All three now anchor at the git root (git stays optional).
+- **`validateRanking` blessed broken rankings.** An array, `{}`, a missing key, or `complete` merely truthy passed the Lock, letting `resolveWorker` return `null` for every tier (routing dead while the Lock read green). Now strict: every tier present + an array, `complete === true`, ≥1 non-empty.
+- **`verify.mjs` used a third, divergent JSONC parser** instead of the shared `stripJsonc` — the gate now validates with the same parser runtime uses.
+- **`grade()` threw on null input** (`{files:null}`, etc.); a boundary authority now degrades instead of crashing.
+
+### Added
+
+- Regression tests across every fix — the case-insensitive/fail-safe floor, the non-English nudge, `mode:"off"`, the stem/whole-word + plural matching (A/B both directions), strict `validateRanking`, the git-root config anchor, and null-input degradation. 110 tests.
+
 ## [1.0.10] - 2026-06-18
 
 Keyword/config-precision hardenings, caught by the 3-sub review pass.

hooks/coaltipple-conductor.js

@@ -19,6 +19,8 @@ const os = require('os');
 // file may be missing/corrupt — each is read in isolation and contributes nothing
 // on failure, so the merge always yields the best available config (never throws).
 // Inlined (not imported) to keep the hook standalone-portable (Phoenix #9).
+// Keep findGitRoot byte-identical to scripts/lib/config-load.mjs + configure.mjs
+// (verify.mjs's config-path-sync gate guards the drift).
 function findGitRoot(startDir) {
   let dir = path.resolve(startDir);
   while (true) {
@@ -59,16 +61,48 @@ function loadCfg() {
 //     fuller file-aware grade). The grader/hint below fires ONLY on a hot
 //     keyword; the always-on routing forcer in main() fires on every prompt. ---
 // <coaltipple-shared: hot-keywords> — synced from scripts/lib/keywords.mjs by build-plugin.mjs; edit keywords.mjs, NOT this block
-const HOT5 = ['concurrency', 'mutex', 'race condition', 'deadlock', 'thread-saf', 'atomic', 'crypto', 'timing attack', 'timing-attack', 'constant-time', 'constant time', 'timing-safe', 'side-channel', 'encrypt', 'decrypt', 'mathematical proof', 'formal proof', 'derive equation', 'complexity bound'];
-const HOT4 = ['oauth', 'authenticat', 'authoriz', 'auth bypass', 'sql injection', 'access control', 'permission', 'secret', 'token', 'password', 'session', 'migration', 'schema change', 'payment', 'billing', 'rate limit', 'optimize query', 'bug scan', 'scan for bugs', 'find bugs', 'find all bugs', 'security audit', 'security review', 'vulnerability scan', 'audit the codebase', 'code audit', 'legal contract', 'compliance', 'license terms', 'financial audit', 'tax filing', 'valuation', 'medical diagnosis', 'clinical diagnosis', 'dosage', 'clinical trial', 'gdpr', 'hipaa', 'pii'];
+const HOT5 = ['concurrency', 'mutex', 'mutexes', 'race condition', 'deadlock', 'deadlocks', 'thread-saf*', 'atomic', 'crypto', 'cryptographic', 'cryptography', 'timing attack', 'timing-attack', 'constant-time', 'constant time', 'timing-safe', 'side-channel', 'encrypt*', 'decrypt*', 'mathematical proof', 'formal proof', 'derive equation', 'complexity bound'];
+const HOT4 = ['oauth', 'authenticat*', 'authoriz*', 'auth bypass', 'sql injection', 'access control', 'permission*', 'secret', 'secrets', 'token', 'tokens', 'password', 'passwords', 'session', 'sessions', 'migrat*', 'schema change', 'payment', 'payments', 'billing', 'rate limit', 'optimize query', 'bug scan', 'scan for bugs', 'find bugs', 'find all bugs', 'security audit', 'security review', 'vulnerability scan', 'audit the codebase', 'code audit', 'legal contract', 'compliance', 'license terms', 'financial audit', 'tax filing', 'valuation', 'medical diagnosis', 'clinical diagnosis', 'dosage', 'clinical trial', 'gdpr', 'hipaa', 'pii'];
 // </coaltipple-shared: hot-keywords>
+// Match a hot keyword with the SAME stem-vs-whole-word convention as the grader
+// (grade.mjs includesAny): a trailing `*` = STEM (prefix, leading \b only); a bare
+// word = WHOLE-WORD (leading + trailing \b), so the conductor's hint can't over-match
+// where the grader doesn't (token -> tokenizer, crypto -> cryptocurrency). `t` is lowercased.
+function matchKw(t, list) {
+  for (const k of list) {
+    const raw = String(k).toLowerCase();
+    const stem = raw.endsWith('*');
+    const word = (stem ? raw.slice(0, -1) : raw).replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    if (!word) continue;
+    if (new RegExp('\\b' + word + (stem ? '' : '\\b')).test(t)) return true;
+  }
+  return false;
+}
 function hintFor(prompt) {
   const t = String(prompt || '').toLowerCase();
-  if (HOT5.some((k) => t.includes(k))) return { grade: 5, tier: 'reasoning', why: 'reasoning-hard keyword' };
-  if (HOT4.some((k) => t.includes(k))) return { grade: 4, tier: 'heavy', why: 'sensitive keyword' };
+  if (matchKw(t, HOT5)) return { grade: 5, tier: 'reasoning', why: 'reasoning-hard keyword' };
+  if (matchKw(t, HOT4)) return { grade: 4, tier: 'heavy', why: 'sensitive keyword' };
   return null;
 }
 
+// The deterministic HOT keyword flags are ENGLISH literals, so a non-English prompt
+// matches NOTHING and the keyword sensitive-gate silently vanishes for it. Detect a
+// non-Latin SCRIPT char — anything outside Basic Latin + Latin-1 Supplement + Latin
+// Extended-A/B (code point <= 0x24F), while excluding the General Punctuation block
+// (0x2000-0x206F: em-dash / smart quotes / ellipsis, common in English text) so an
+// English prompt with typographic punctuation does NOT trigger a false nudge. Catches
+// Thai / CJK / Arabic / Cyrillic / Hebrew / Devanagari / etc. The character class is
+// BUILT from char codes — never a raw high-Unicode literal in source (the tool layer
+// mangles those; this hook must stay deterministic + portable, Phoenix #8/#9).
+const NON_LATIN_RE = (() => {
+  const cc = String.fromCharCode;
+  const cls = '[^' + cc(0x00) + '-' + cc(0x24f) + cc(0x2000) + '-' + cc(0x206f) + ']';
+  return new RegExp(cls);
+})();
+function hasNonLatinScript(prompt) {
+  return NON_LATIN_RE.test(String(prompt || ''));
+}
+
 // The contract is model-facing English (the model reads it fine); the language
 // LEVER is a directive telling the model what language to PRODUCE for the user —
 // the same approach CoalMine's conductor uses. cfg.language drives it, so the
@@ -86,6 +120,7 @@ function contract(cfg) {
     '- DELEGATE-DOWN a task you can do but is large + cheap, to a lower tier — ONLY with a compact task-contract (goal+constraints+interface+done) AND verify the returned output on merge. Skip it for small tasks (spawn overhead beats the saving).',
     '- ESCALATE-UP a task beyond the current tier for quality. Workers are leaves by policy (routing stays depth-0): give each a bounded task-contract so it RETURNS rather than spawning its own workers; a worker that fails RETURNS its result and the MAIN re-routes.',
     '- Grade by the deterministic rubric, not a model self-assessment. Opus is scarce: cheapest lever first - raise effort, then a stronger same-tier version (e.g. Opus 4.6 -> 4.8), before escalating the tier.',
+    '- mode (.coaltipple.json, default auto): auto = route both directions per grade; delegation = delegate-down only (escalate-up suppressed, a budget-saving mode); escalation = escalate-up only (delegate-down suppressed, a quality mode); off = routing off, do it yourself. The sensitive HARD GATE overrides mode (sensitive is still never-down and may always escalate up).',
     '- Honor qualityBar (.coaltipple.json, 0-100, default 60): a result must clear it or climb the model ladder — start at the grade floor, verify vs the contract done-criteria by domain-appropriate means (code: tests/build; text: completeness; research: sourced claims), climb one rung if short, jump to the top tier if far below or out of attempts. 0 = anything passes (cheapest); 100 = climb until best.',
     langLine(cfg),
     '- Consent + token spend: honor .coaltipple.json; never silently fan out costly work.',
@@ -96,9 +131,18 @@ function readStdin() {
   try { return fs.readFileSync(0, 'utf8'); } catch { return ''; }
 }
 
+// Routing is OFF when the master switch is off OR mode is "off" (do-it-yourself).
+// Both silence the SessionStart contract AND the per-prompt forcer — the off switch.
+function routingOff(cfg) {
+  if (!cfg) return false;
+  if (cfg.enableRouting === false || cfg.routing === false) return true; // legacy key honored
+  if (typeof cfg.mode === 'string' && cfg.mode.toLowerCase() === 'off') return true; // mode:"off" short-circuit
+  return false;
+}
+
 function main() {
   const cfg = loadCfg();
-  if (cfg && (cfg.enableRouting === false || cfg.routing === false)) return; // legacy key honored
+  if (routingOff(cfg)) return;
   const disabled = cfg && cfg.disableRouting;
   if (Array.isArray(disabled) && disabled.includes('all')) return;
 
@@ -107,9 +151,14 @@ function main() {
   const event = input.hook_event_name || input.hookEventName || '';
 
   if (event === 'UserPromptSubmit') {
-    const h = hintFor(input.prompt || input.user_prompt || '');
+    const prompt = input.prompt || input.user_prompt || '';
+    const h = hintFor(prompt);
     const hint = h ? ` Complexity hint: grade ${h.grade} (${h.why}) -> start tier "${h.tier}"; fold into the grade, then the result must clear qualityBar or routing climbs the ladder.` : '';
-    process.stdout.write(`[CoalTipple] Route BEFORE acting on this prompt: apply the coaltipple routing contract (SKILL.md) -- grade the task, then delegate-down (large + cheap), escalate-up (beyond this tier), or keep-on-self, per the rubric. Routing actuates on Claude Code only.${hint}`);
+    // The English HOT-keyword hint cannot fire on a non-English prompt; add ONE generic
+    // deterministic nudge so the sensitive-gate backstop is not silently lost there.
+    // Complements (never replaces) the English hint above.
+    const nonEnglish = hasNonLatinScript(prompt) ? ' Non-English prompt -- grade by MEANING and apply the sensitive-gate by intent; the English keyword flags will not fire.' : '';
+    process.stdout.write(`[CoalTipple] Route BEFORE acting on this prompt: apply the coaltipple routing contract (SKILL.md) -- grade the task, then delegate-down (large + cheap), escalate-up (beyond this tier), or keep-on-self, per the rubric. Routing actuates on Claude Code only.${hint}${nonEnglish}`);
     return;
   }
   // SessionStart (and any non-prompt event) -> inject the routing contract.

platform-configs/.coaltipple.json

@@ -96,7 +96,7 @@
   "rankingMode": "auto",
 
   // ## Optional pins that override auto-classification — e.g. when introspection is unclear (a renamed flagship).
-  // # Setting type: Object { low | mid | heavy | reasoning | local : "model" | ["priority", "chain"] }
+  // # Setting type: Object { local | low | mid | heavy | reasoning : "model" | ["priority", "chain"] }  (cheapest tier is `low`, not `cheap`)
   // # Default value: unset (auto-classify by introspection; the heuristic floor is the last resort)
   // "modelTiers": { "low": "haiku", "mid": "sonnet", "heavy": "opus", "reasoning": ["Fable 5", "opus"] },
 
@@ -138,10 +138,10 @@
   // # The value below is GENERATED from keywords.mjs (the SSoT) by build-plugin.mjs; verify.mjs fails on drift.
 // <coaltipple-shared: keywords>
   "keywords": {
-    "concurrency": { "grade": 5, "words": ["concurrency", "mutex", "race condition", "deadlock", "thread-saf", "atomic"] },
-    "crypto": { "grade": 5, "sensitive": true, "words": ["crypto", "timing attack", "timing-attack", "constant-time", "constant time", "timing-safe", "side-channel", "encrypt", "decrypt"] },
-    "security": { "grade": 4, "sensitive": true, "words": ["oauth", "authenticat", "authoriz", "auth bypass", "sql injection", "access control", "permission", "secret", "token", "password", "session"] },
-    "coding": { "grade": 4, "sensitive": true, "words": ["migration", "schema change", "payment", "billing", "rate limit", "optimize query"] },
+    "concurrency": { "grade": 5, "words": ["concurrency", "mutex", "mutexes", "race condition", "deadlock", "deadlocks", "thread-saf*", "atomic"] },
+    "crypto": { "grade": 5, "sensitive": true, "words": ["crypto", "cryptographic", "cryptography", "timing attack", "timing-attack", "constant-time", "constant time", "timing-safe", "side-channel", "encrypt*", "decrypt*"] },
+    "security": { "grade": 4, "sensitive": true, "words": ["oauth", "authenticat*", "authoriz*", "auth bypass", "sql injection", "access control", "permission*", "secret", "secrets", "token", "tokens", "password", "passwords", "session", "sessions"] },
+    "coding": { "grade": 4, "sensitive": true, "words": ["migrat*", "schema change", "payment", "payments", "billing", "rate limit", "optimize query"] },
     "audit": { "grade": 4, "words": ["bug scan", "scan for bugs", "find bugs", "find all bugs", "security audit", "security review", "vulnerability scan", "audit the codebase", "code audit"] },
     "math": { "grade": 5, "words": ["mathematical proof", "formal proof", "derive equation", "complexity bound"] },
     "knowledge": { "grade": 3, "words": ["systematic review", "literature review", "citation", "claim verification"] },

plugin/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "coaltipple",
-  "version": "1.0.10",
+  "version": "1.0.11",
   "description": "CoalTipple — model/effort router for Claude Code. Delegates a task you CAN do but is large+cheap DOWN to a lower tier to save tokens; escalates a task beyond the current tier UP for quality. Two-knob routing (tier × effort, effort-before-tier), introspection-first model classification, a validity-gated ranking Lock that never routes on broken state, and git-optional damage control. Advise-only Phoenix-pure hook; the model performs the routing.",
   "author": { "name": "HetCreep" },
   "homepage": "https://github.com/TheColliery/CoalTipple",