I3143 — Each provider lifecycle event leaves a typed receipt written by the domain before any guard can return early

✕BLOCKED wave 3 · p1 · implementation profile · parallel safe

Part of the-session-domain-is-written-once — The session lifecycle is written by the typed domain, and the shell only parses and renders.

Objective

ADR 0047 step 3: the provider hook shims call the domain instead of capture session, and every start, compact, end and prompt event writes a received or failed receipt with its diagnostic.

Why

The six-day outage of 2026-09-05 was three guards that refused correctly, wrote to stderr and returned 0 (case 130). The inventory records that mj_capture_session_start returns 0 on every failure path. Sources: chatgpt-majordomus:c109#3.

Current state

.claude/hooks/majordomus-session-{start,compact,end} exec bin/majordomus capture session --event ...; lib/capture.sh decides; the receipt is already written before any guard (mj_capture_session_receipt) and case 408 holds that it is provider neutral.

Desired state

The shims exec one domain command; a silent early return is impossible; a failed event shows in health.

Scope

• .claude/hooks
• lib/capture.sh
• apps/majordomus-cli/src/session
• apps/majordomus-cli/src/capability/builtin/lifecycle.rs
• share/events.yaml

Out of scope

• Changing the provider's fail-open contract: a hook still never blocks the provider

Dependencies

• I3142✕BLOCKED An episode opens through the typed domain and records the task and issue it began on
• I3320○READY A lifecycle command run against an absent or stale executable fails loudly and never falls back to a shell writer

What waits on this

• I3145✕BLOCKED Continuity is resolved and judged fresh by one function, and the shell's copies are deleted

Acceptance criteria

• A forced failure in each event writes a failed receipt naming the cause
• health reports a failed receipt
• The shims stay generated and fail-open

Validation

• bash test/run.sh --no-skips 54_session_lifecycle_hooks 408_a_receipt_is_provider_neutral 130_lifecycle_survives_a_stale_task

Evidence required

• case_every_event_leaves_a_receipt

Evidence

None recorded. Every token above needs a command or an artifact behind it before this issue can be completed; narrative is refused.

Timeline

started

—

verified

—

completed

—

Those three fields, the evidence above and the state of the dependencies are all the status is made of. There is no status field to disagree with them.

Canonical record: .ai/repo/project/issues/I3143.yaml. Read it back with majordomus plan show I3143.