Another deep audit and production-hardening pass is complete. Here is what landed:

Write-path enforcement (fail-closed)
_pre_tool_call in roadmap_hooks.py — blocks write_file / patch targeting ROADMAP.md outside the resolved project workspace before the tool runs (kernel/joyzoning pattern).
Wired into hooks.py pre-tool chain: kernel_pre → jz_pre → roadmap_pre.
Config: block_writes_outside_workspace: true (default).
Bootstrap completeness gate
New bootstrap_complete gate in gate.py — detects unfilled template guidance via workspace state.
Optional kanban block via block_kanban_on_bootstrap_incomplete: false (default; opt-in).
Operator hints recommend fill_bootstrap when placeholders remain.
Agent ergonomics
Session hooks use build_steering_context() — emit roadmap_path, workspace_source, handle unresolved workspace gracefully.
JoyZoning next_actions now surface ROADMAP path and bootstrap-fill hints.
Session brief includes bootstrap_complete / bootstrap_placeholder_count.
Evidence-driven bootstrap (fewer generic phrases)
bootstrap_skeleton_from_evidence() derives users, workflows, architecture from README/git evidence instead of static template lines.
Skeleton no longer emits phrases like “Derived from README and config evidence during bootstrap.”
Audit + tests
Audit covers pre_tool_call block, joyzoning merge hints, and production-language scan exceptions for bootstrap gate labels.
New tests: RoadmapHooksTests (pre_tool_call block + optional bootstrap gate).
Verification
make verify  → smoke OK, audit OK, 58 tests OK
Opt-in knobs in ~/.hermes/config.yaml:

dietcode:
  roadmap:
    block_writes_outside_workspace: true      # blocks bad ROADMAP writes at pre_tool_call
    block_kanban_on_bootstrap_incomplete: false # set true to block kanban until bootstrap filled
Run make deploy-fast to sync to your active Hermes plugin if you want these changes live in the IDE.

Author: CardSorting

.dietcode/roadmap-state.json

@@ -0,0 +1,10 @@
+{
+  "last_validated_at": "2026-06-10T22:14:53Z",
+  "schema_valid": false,
+  "health_status": null,
+  "recent_checkpoint_date": null,
+  "phase": "validate_pending",
+  "validation_issue_count": 1,
+  "validation_pending": false,
+  "updated_at": "2026-06-10T22:14:53Z"
+}

lib/agent/roadmap/cockpit.py

@@ -12,11 +12,19 @@
 from plugins.dietcode.lib.agent.roadmap.progress import read_current, read_last_error
 from plugins.dietcode.lib.agent.roadmap.snapshot import get_workspace_snapshot
 from plugins.dietcode.lib.agent.roadmap.skill_install import _SKILL_REL
+from plugins.dietcode.lib.agent.roadmap.steering_context import build_steering_context
 
 
 def build_cockpit_payload(*, workspace: Optional[str] = None) -> dict[str, Any]:
     cfg = get_roadmap_config()
-    root = resolve_workspace_root(workspace)
+    if workspace and str(workspace).strip():
+        root = resolve_workspace_root(workspace)
+        workspace_source = "explicit"
+    else:
+        from plugins.dietcode.lib.agent.roadmap.config import resolve_workspace
+
+        root, workspace_source = resolve_workspace()
+    steering = build_steering_context(workspace=root)
     snap = get_workspace_snapshot(root, tier="full")
     evidence = snap.evidence
     roadmap = evidence.get("roadmap") or {}
@@ -57,6 +65,10 @@ def build_cockpit_payload(*, workspace: Optional[str] = None) -> dict[str, Any]:
             "ok": True,
             "generated_at": datetime.now(timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ"),
             "workspace": root,
+            "workspace_source": workspace_source,
+            "workspace_safe": steering.get("workspace_safe", True),
+            "bootstrap_complete": ws_state.get("bootstrap_complete"),
+            "bootstrap_placeholder_count": ws_state.get("bootstrap_placeholder_count"),
             "enabled": cfg.enabled,
             "skill_path": _SKILL_REL,
             "roadmap_exists": bool(roadmap.get("exists")),
@@ -96,10 +108,15 @@ def format_cockpit_report(*, workspace: Optional[str] = None) -> str:
     lines = [
         "🗺️ Roadmap cockpit",
         f"Workspace: {data.get('workspace')}",
+        f"ROADMAP.md: {data.get('roadmap_path')}",
+    ]
+    if data.get("workspace_source"):
+        lines.append(f"Workspace source: {data['workspace_source']}")
+    lines.extend([
         f"Phase: {data.get('phase')}",
         f"Enabled: {data.get('enabled')}",
         "",
-    ]
+    ])
 
     if data.get("roadmap_exists"):
         lines.append(f"ROADMAP.md: present | health={data.get('health_status') or 'unparsed'}")
@@ -125,6 +142,10 @@ def format_cockpit_report(*, workspace: Optional[str] = None) -> str:
         for sig in signals[:3]:
             lines.append(f"  • {sig.get('code')}: {sig.get('detail')}")
 
+    if data.get("bootstrap_complete") is False and data.get("bootstrap_placeholder_count"):
+        lines.append(
+            f"⚠️  Bootstrap placeholders: {data['bootstrap_placeholder_count']} — replace template text before closing pass"
+        )
     lines.append("")
     lines.append(data.get("operator_summary") or "")
     if data.get("progress_phase"):

lib/agent/roadmap/config.py

@@ -4,6 +4,7 @@
 import os
 import time
 from dataclasses import dataclass
+from pathlib import Path
 from typing import Optional
 
 _config_cache: Optional["RoadmapConfig"] = None
@@ -67,24 +68,133 @@ def get_roadmap_config() -> RoadmapConfig:
     return _config_cache
 
 
-def resolve_workspace_root(explicit: Optional[str] = None) -> str:
-    """Resolve the project workspace for ROADMAP.md."""
+class RoadmapWorkspaceError(ValueError):
+    """Project workspace for ROADMAP.md could not be resolved safely."""
+
+
+def _reject_quarantined(root: str) -> None:
+    try:
+        from plugins.dietcode.lib.kernel_workspace import is_quarantined_root
+    except ImportError:
+        return
+    if is_quarantined_root(root):
+        raise RoadmapWorkspaceError(
+            f"ROADMAP.md belongs in your Hermes project workspace, not the DietCode plugin tree: {root}. "
+            "Set kanban.workspace or HERMES_KANBAN_WORKSPACE to your project root."
+        )
+
+
+def _candidate_from_env() -> tuple[Optional[str], str]:
+    for key in (
+        "HERMES_KANBAN_WORKSPACE",
+        "JOYZONING_WORKSPACE_ROOT",
+        "DIETCODE_WORKSPACE_ROOT",
+    ):
+        val = os.environ.get(key, "").strip()
+        if not val:
+            continue
+        root = str(Path(val).expanduser().resolve())
+        try:
+            from plugins.dietcode.lib.kernel_workspace import is_quarantined_root
+
+            if is_quarantined_root(root):
+                continue
+        except ImportError:
+            pass
+        return root, key
+    return None, "env:unset"
+
+
+def _candidate_from_kanban_config() -> tuple[Optional[str], str]:
+    try:
+        from hermes_cli.config import load_config
+
+        raw = load_config()
+        if not isinstance(raw, dict):
+            return None, "kanban:unset"
+        kanban = raw.get("kanban", {})
+        if not isinstance(kanban, dict):
+            return None, "kanban:unset"
+        ws = str(kanban.get("workspace") or kanban.get("workspace_root") or "").strip()
+        if not ws:
+            return None, "kanban:unset"
+        root = str(Path(ws).expanduser().resolve())
+        try:
+            from plugins.dietcode.lib.kernel_workspace import is_quarantined_root
+
+            if is_quarantined_root(root):
+                return None, "kanban:quarantined"
+        except ImportError:
+            pass
+        return root, "kanban.workspace"
+    except Exception:
+        return None, "kanban:unset"
+
+
+def resolve_workspace(*, explicit: Optional[str] = None) -> tuple[str, str]:
+    """Resolve the user project workspace for ROADMAP.md (never plugin/kernel trees).
+
+    Returns ``(absolute_path, resolution_source)``.
+    """
     if explicit and str(explicit).strip():
-        from pathlib import Path
+        root = str(Path(explicit).expanduser().resolve())
+        _reject_quarantined(root)
+        return root, "explicit"
 
-        return str(Path(explicit).expanduser().resolve())
+    try:
+        from plugins.dietcode.lib.kernel_workspace import (
+            is_quarantined_root,
+            resolve_workspace_root as resolve_kernel_workspace,
+        )
+
+        report = resolve_kernel_workspace()
+        candidate = report.resolved_workspace_root
+        if candidate and not is_quarantined_root(candidate):
+            return candidate, report.resolution_detail
+    except Exception:
+        pass
 
     try:
         from plugins.dietcode.lib.agent.joyzoning.jsdp_harness_client import (
             resolve_workspace_root as _jz_resolve,
         )
 
-        return _jz_resolve(explicit=None)
+        jz_root = _jz_resolve(explicit=None)
+        if jz_root:
+            try:
+                from plugins.dietcode.lib.kernel_workspace import is_quarantined_root
+
+                if not is_quarantined_root(jz_root):
+                    return jz_root, "joyzoning.jsdp"
+            except ImportError:
+                return jz_root, "joyzoning.jsdp"
     except Exception:
-        from pathlib import Path
+        pass
+
+    env_root, env_source = _candidate_from_env()
+    if env_root:
+        return env_root, env_source
 
-        for key in ("HERMES_KANBAN_WORKSPACE", "JOYZONING_WORKSPACE_ROOT"):
-            val = os.environ.get(key, "").strip()
-            if val:
-                return str(Path(val).expanduser().resolve())
-        return str(Path.cwd().resolve())
+    kanban_root, kanban_source = _candidate_from_kanban_config()
+    if kanban_root:
+        return kanban_root, kanban_source
+
+    cwd = str(Path.cwd().resolve())
+    try:
+        from plugins.dietcode.lib.kernel_workspace import is_quarantined_root
+
+        if not is_quarantined_root(cwd):
+            return cwd, "cwd"
+    except ImportError:
+        return cwd, "cwd"
+
+    raise RoadmapWorkspaceError(
+        "Could not resolve a project workspace for ROADMAP.md. "
+        "Set kanban.workspace in ~/.hermes/config.yaml or export HERMES_KANBAN_WORKSPACE "
+        "to your project root (not ~/.hermes/plugins/dietcode)."
+    )
+
+
+def resolve_workspace_root(explicit: Optional[str] = None) -> str:
+    """Resolve the project workspace for ROADMAP.md."""
+    return resolve_workspace(explicit=explicit)[0]

lib/agent/roadmap/doctor.py

@@ -14,14 +14,51 @@
 
 def run_checks(*, workspace: Optional[str] = None) -> dict[str, Any]:
     cfg = get_roadmap_config()
-    root = resolve_workspace_root(workspace)
+    from plugins.dietcode.lib.agent.roadmap.config import RoadmapWorkspaceError, resolve_workspace
+
+    workspace_source = "explicit"
+    try:
+        if workspace and str(workspace).strip():
+            root = resolve_workspace_root(workspace)
+        else:
+            root, workspace_source = resolve_workspace()
+    except RoadmapWorkspaceError as exc:
+        return {
+            "success": False,
+            "ok": False,
+            "workspace": None,
+            "workspace_source": "unresolved",
+            "enabled": cfg.enabled,
+            "checks": [{"name": "workspace_resolved", "ok": False, "detail": str(exc)}],
+            "recommendations": [
+                "Set kanban.workspace in ~/.hermes/config.yaml",
+                "export HERMES_KANBAN_WORKSPACE=/path/to/your/project",
+            ],
+            "recommended_next_action": {
+                "action": "configure_workspace",
+                "command": "export HERMES_KANBAN_WORKSPACE=/path/to/project",
+                "detail": str(exc),
+            },
+        }
+
     checks: list[dict[str, Any]] = []
     recommendations: list[str] = []
 
     def _check(name: str, ok: bool, detail: str = "") -> None:
         checks.append({"name": name, "ok": ok, "detail": detail})
 
     _check("roadmap.enabled", cfg.enabled, "enabled" if cfg.enabled else "disabled in config")
+    try:
+        from plugins.dietcode.lib.kernel_workspace import is_quarantined_root
+
+        _check(
+            "workspace_not_plugin_tree",
+            not is_quarantined_root(root),
+            f"{root} ({workspace_source})",
+        )
+    except ImportError:
+        pass
+
     _check(
         "auto_install_skills",
         True,
@@ -129,6 +166,7 @@ def _check(name: str, ok: bool, detail: str = "") -> None:
         "success": ok,
         "ok": ok,
         "workspace": root,
+        "workspace_source": workspace_source,
         "enabled": cfg.enabled,
         "checks": checks,
         "validation": validation.to_dict() if validation else None,

lib/agent/roadmap/errors.py

@@ -41,7 +41,8 @@ def error_envelope(
 def _recovery_for_code(code: str, action: str) -> str:
     mapping = {
         "roadmap_disabled": "Set dietcode.roadmap.enabled: true in Hermes config",
-        "workspace_unresolved": "Set HERMES_KANBAN_WORKSPACE or run from project root",
+        "workspace_unresolved": "Set kanban.workspace in ~/.hermes/config.yaml or export HERMES_KANBAN_WORKSPACE",
+        "workspace_quarantined": "Point workspace at your project — never ~/.hermes/plugins/dietcode",
         "roadmap_missing": "roadmap(action='checkpoint') to bootstrap ROADMAP.md",
         "schema_invalid": "roadmap(action='validate') then repair reported issues",
         "checkpoint_stale": "roadmap(action='checkpoint', context='stale refresh')",
@@ -82,10 +83,13 @@ def as_tool_error(payload: dict[str, Any]) -> str:
 
 
 def from_exception(exc: Exception, *, action: str = "") -> dict[str, Any]:
+    from plugins.dietcode.lib.agent.roadmap.config import RoadmapWorkspaceError
+
+    code = "workspace_unresolved" if isinstance(exc, RoadmapWorkspaceError) else "roadmap_failed"
     return error_envelope(
-        code="roadmap_failed",
+        code=code,
         message=str(exc),
         action=action,
         detail=type(exc).__name__,
-        safe_to_retry=True,
+        safe_to_retry=not isinstance(exc, RoadmapWorkspaceError),
     )

lib/agent/roadmap/gate.py

@@ -96,6 +96,15 @@ def _check_checkpoint_fresh(_: dict[str, Any], inputs: dict[str, Any]) -> bool:
     return not bool((inputs.get("freshness") or {}).get("stale"))
 
 
+def _check_workspace_safe(_: dict[str, Any], inputs: dict[str, Any]) -> bool:
+    try:
+        from plugins.dietcode.lib.kernel_workspace import is_quarantined_root
+    except ImportError:
+        return True
+    ws = str(inputs.get("workspace") or "")
+    return bool(ws) and not is_quarantined_root(ws)
+
+
 def _check_skill_installed(_: dict[str, Any], inputs: dict[str, Any]) -> bool:
     root = inputs.get("workspace") or resolve_workspace_root()
     skill = (
@@ -125,6 +134,15 @@ def _check_validation_current(_: dict[str, Any], inputs: dict[str, Any]) -> bool
         "safe": True,
         "blocks_kanban_complete": False,
     },
+    {
+        "id": "workspace_safe",
+        "label": "Project workspace (not plugin install tree)",
+        "is_open": _check_workspace_safe,
+        "why_closed": "ROADMAP.md must live in the Hermes project workspace, not the DietCode plugin directory",
+        "fix": "Set kanban.workspace or HERMES_KANBAN_WORKSPACE to your project root",
+        "safe": True,
+        "blocks_kanban_complete": True,
+    },
     {
         "id": "roadmap_present",
         "label": "ROADMAP.md exists",