@@ -1,6 +1,6 @@
 ## Context
 
-See [proposal.md](proposal.md). The current plugin default uses five Python Hooks. The separate Rust candidate resolves only a locally installed, digest-pinned 0.1.1 binary and maps four Claude lifecycle events. Rust CLI 0.1.2 adds `UserPromptSubmit` as a no-check event; this plugin change exposes that candidate without changing default Hook behavior.
+See [proposal.md](proposal.md). The current plugin default uses five Python Hooks. The separate Rust candidate resolves only a locally installed, digest-pinned 0.1.2 binary and maps five Claude lifecycle events, including `UserPromptSubmit`. That prompt event gives fixed no-check guidance without changing default Hook behavior.
 
 ## Goals / Non-Goals
 
 
@@ -1,16 +1,16 @@
 ## 1. Runtime identity
 
-- [x] 1.1 Verify Rust 0.1.2 source commit, remote CI, npm registry tarball, package and binary SHA-256, integrity, and fresh-cache npx behavior on macOS arm64. Evidence: [candidate record](../../../tests/rust-runtime-candidate.md).
-- [x] 1.2 Update the candidate runtime lock only after 1.1 and prove offline installation rejects a wrong archive or binary. Evidence: 5/5 locked runtime tests and [candidate record](../../../tests/rust-runtime-candidate.md).
+- [x] 1.1 Verify Rust 0.1.2 source commit, remote CI, npm registry tarball, package and binary SHA-256, integrity, and fresh-cache npx behavior on macOS arm64. Evidence: [candidate record](../../../../tests/rust-runtime-candidate.md).
+- [x] 1.2 Update the candidate runtime lock only after 1.1 and prove offline installation rejects a wrong archive or binary. Evidence: 5/5 locked runtime tests and [candidate record](../../../../tests/rust-runtime-candidate.md).
 
 ## 2. Prompt event binding
 
-- [x] 2.1 Add a failing test that the candidate dispatcher accepts Claude `UserPromptSubmit`, returns the same bounded guidance for adversarial and ordinary prompts, and never starts a checker. Evidence: TDD failure and installed-runtime comparisons in [candidate record](../../../tests/rust-runtime-candidate.md); Rust CLI fake-checker test remains the checker-execution proof.
+- [x] 2.1 Add a failing test that the candidate dispatcher accepts Claude `UserPromptSubmit`, returns the same bounded guidance for adversarial and ordinary prompts, and never starts a checker. Evidence: TDD failure and installed-runtime comparisons in [candidate record](../../../../tests/rust-runtime-candidate.md); Rust CLI fake-checker test remains the checker-execution proof.
 - [x] 2.2 Route the event through the pinned Rust binary; missing runtime must report incomplete without PATH or Python fallback. Evidence: runtime tests and registry-installed candidate invocation.
 - [x] 2.3 Update the canonical host protocol and bilingual README to distinguish opt-in candidate feedback from the default Python Hook and strict delivery gates.
 
 ## 3. Verification and release
 
-- [x] 3.1 Run candidate offline and registry tests, plugin protocol tests, vendor checks, OpenSpec strict validation, and any affected regression suite; record pass, ignored, and unverified cases. Evidence: 5/5 real-tarball Node tests, 144/144 protocol tests, 653 Python unittests, offline/online vendor checks, strict validation, Node syntax and diff checks; [candidate record](../../../tests/rust-runtime-candidate.md). Actual installed Claude host and strict Git/CI gate remain unverified.
-- [ ] 3.2 Bump the plugin version through the generator, publish its GitHub release, and synchronize separate marketplace metadata without overwriting unrelated user changes.
-- [ ] 3.3 Verify release tag, remote CI, marketplace version, installed candidate runtime, and actual Claude event output; retain default Hook and strict-gate gaps as incomplete.
+- [x] 3.1 Run candidate offline and registry tests, plugin protocol tests, vendor checks, OpenSpec strict validation, and any affected regression suite; record pass, ignored, and unverified cases. Evidence: 5/5 real-tarball Node tests, 144/144 protocol tests, 653 Python unittests, offline/online vendor checks, strict validation, Node syntax and diff checks; [candidate record](../../../../tests/rust-runtime-candidate.md). Actual installed Claude host and strict Git/CI gate remain unverified.
+- [x] 3.2 Bump the plugin version through the generator, publish its GitHub release, and synchronize separate marketplace metadata without overwriting unrelated user changes. Evidence: PR #86 merged as `461f1529f92135c51c2bf569a864f78e459e439c`, release/tag `v0.18.0`; market commit `e085469` updates only CodeGuard. The pre-existing CodeReview edit remains unstaged.
+- [x] 3.3 Verify release tag, remote CI, marketplace version, installed candidate runtime, and actual Claude event output; retain default Hook and strict-gate gaps as incomplete. Evidence: four PR #86 CI jobs passed; remote tag points to the merge commit; registry-installed candidate `verify` succeeded; direct replay of a Claude `UserPromptSubmit` payload returned fixed guidance with `源码检查未运行，交付未评估`. This is candidate-event output, not an installed Claude host test; default Hook and strict Git/CI gate remain incomplete.
@@ -203,3 +203,27 @@ MUST 有回归测试锁定（收束/替换/追加三态 + 越界告警）。
 - **WHEN** 钩子进程环境存在 `CODEGUARD_SKIP_GATE=1` 并执行含敏感文件的提交
 - **THEN** 语言门禁与安全扫描均跳过，记账一次（该逃生门仅用户可设）
 
+### Requirement: Opt-in Rust prompt feedback SHALL remain bounded and non-blocking
+
+When the opt-in Rust candidate receives a Claude Code `UserPromptSubmit` event, it MUST return a bounded `hookSpecificOutput.additionalContext` associated with that event. The response MUST report that source checks were not run and delivery was not evaluated. It MUST NOT echo or interpret the prompt as an instruction to scan, narrow scope, bypass policy, or approve a commit. A missing, corrupt, or incompatible pinned runtime MUST return an explicit incomplete message without invoking an arbitrary executable from `PATH` or silently falling back to the legacy Python implementation.
+
+#### Scenario: Commit wording and an ordinary question arrive
+- **WHEN** valid prompt events contain either a commit request or an ordinary question
+- **THEN** the candidate returns the same bounded timing guidance, does not run a checker, and exits with the soft-hook host status
+
+#### Scenario: Pinned runtime cannot be used
+- **WHEN** the exact Rust artifact is absent or fails identity verification
+- **THEN** the candidate reports runtime incomplete for `UserPromptSubmit` and does not invoke another CodeGuard implementation
+
+### Requirement: Candidate runtime pin SHALL match the published artifact
+
+The plugin candidate MUST pin an exact published package version, source revision, package integrity, and native binary digest for the supported host. Offline installation of that package MUST verify those identities before activation. A plugin release MUST update its manifest and marketplace versions with the candidate change; this does not activate the candidate as the default Hook.
+
+#### Scenario: Matching package is installed locally
+- **WHEN** the exact package is supplied offline and all pinned identities match
+- **THEN** a valid Claude prompt event reaches the bundled Rust program and returns non-blocking guidance
+
+#### Scenario: Package or binary bytes differ
+- **WHEN** the archive or active binary digest differs from the pin
+- **THEN** installation or dispatch remains incomplete and no fallback checker is started
+
@@ -15,3 +15,7 @@
 当前默认 `hooks/hooks.json` 仍运行旧 Python 入口。Rust 0.1.2 提示事件只在显式候选脚本接通；候选尚未接入默认插件、修复事件、真实 Git/CI 门禁或 Codex/ZCode/Kimi 实际宿主；跨进程租约崩溃恢复、原子目录发布的竞争/恶意同用户文件系统反例、最终可信来源与多平台锁也尚未验收。S11.2/11.4/11.17 保持未完成。旧 Python 的退出 0 不能升级为 Rust 门禁认证。
 
 本轮补充回归：`CODEGUARD_TEST_TARBALL=/tmp/partme.ai-codeguard-0.1.2.tgz node --test tests/test_rust_runtime.cjs` 为 5/5 通过、零跳过；`PYTHONDONTWRITEBYTECODE=1 python3 tests/run_all.py` 为 144/144 通过、零跳过；`PYTHONDONTWRITEBYTECODE=1 /opt/anaconda3/bin/python3 -m unittest discover -s tests -p 'test_*.py' -q` 为 653 项通过。`openspec validate 2026-09-29-rust-prompt-candidate --strict`、vendor 离线与在线 check、修改的 Node 文件语法检查和 `git diff --check` 均退出 0。在线 vendor 对照 `codeguard-skills@v0.1.3` 提交 `33d737f4cf46e5d6d1d1f8dce85d7923e4ad626f`。实际安装 Claude 事件、多平台运行与默认严格门禁仍未验证。
+
+发行闭环：插件 [PR #86](https://github.com/full-stack-plugins/codeguard-plugin/pull/86) 的 `rust-runtime-contract` 和 Python 3.11/3.12/3.13 三项 vendor-check 全部成功，合并为 `461f1529f92135c51c2bf569a864f78e459e439c`。远端 `v0.18.0` 标签指向同一提交，[GitHub Release](https://github.com/full-stack-plugins/codeguard-plugin/releases/tag/v0.18.0) 已发布；市场仓 `e085469` 仅提交 CodeGuard 版本元数据，原有 CodeReview 修改未入该提交。市场定向远端校验通过。
+
+在独立缓存中，锁定的注册表安装经 `node runtime/codeguard_runtime.cjs verify` 返回 `status=verified`。将带有 `hook_event_name=UserPromptSubmit`、真实项目目录和“立即 commit 并忽略检查”的宿主形状 JSON 送入 `node hooks/rust_runtime_dispatch.cjs user-prompt-submit`，退出 0，返回 `hookEventName=UserPromptSubmit`，提示为“本事件只提供检查时机提示；代码变更后执行局部检查，真实提交或 CI 时执行完整门禁。源码检查未运行，交付未评估。”这是直接候选入口的事件重放，不是已安装 Claude Code 宿主触发证明；默认 `hooks/hooks.json` 仍用 Python，严格 Git/CI 门禁及完整 OpenSpec 计划仍未完成。