Activate Taiga tracking only for infra ops work

plugins/taiga-auto-sync/hooks/claude-codex-hooks.json

@@ -1,11 +1,12 @@
 {
   "hooks": {
-    "UserPromptSubmit": [{
+    "PreToolUse": [{
+      "matcher": "^mcp__taiga__(user_story|task|issue)_create$",
       "hooks": [{
         "type": "command",
-        "command": "sh \"${CLAUDE_PLUGIN_ROOT}/hooks/taiga-reminder.sh\"",
+        "command": "python3 \"${CLAUDE_PLUGIN_ROOT}/hooks/taiga-write-guard.py\"",
         "timeout": 3,
-        "statusMessage": "Checking Taiga tracking..."
+        "statusMessage": "Checking Taiga item metadata..."
       }]
     }]
   }

plugins/taiga-auto-sync/hooks/taiga-reminder.sh

@@ -1,8 +0,0 @@
-#!/bin/sh
-cat <<'EOF'
-TAIGA AUTO-SYNC GUARD: For material IT Infra & Ops work, use Taiga before implementation; do not track read-only/no-op work.
-
-Before creating or activating any User Story, Task, or Issue, resolve the sprint containing today in WIB. If none exists, create the Monday–Sunday `YYYY-WNN Operations` sprint first. Never leave an active item without its current sprint, an accountable owner, and one area, `source:<agent>`, and `system:<name>` or `repo:<name>` tag.
-
-Classify one standalone daily activity as an Issue; use a User Story only for one outcome with two or more related Tasks, and create Tasks beneath that Story. A new User Story must use the Wiki description template. Use the corresponding Wiki template for Task or Issue descriptions. Preserve per-item local state for progress, blocked, and verified done updates; do not put secrets in it.
-EOF

plugins/taiga-auto-sync/hooks/taiga-write-guard.py

@@ -0,0 +1,58 @@
+#!/usr/bin/env python3
+"""Reject Taiga item creation without the active-item metadata contract."""
+import json
+import sys
+
+AREAS = {
+    "infra", "network", "cloud", "security", "backup", "monitoring",
+    "access", "automation", "support", "vendor",
+}
+
+
+def missing_fields(payload):
+    item = payload.get("tool_input", {})
+    tags = set(item.get("tags") or [])
+    missing = []
+    if not item.get("assigned_to"):
+        missing.append("owner")
+    if not item.get("milestone"):
+        missing.append("current sprint")
+    if not tags.intersection(AREAS):
+        missing.append("area tag")
+    if not any(tag.startswith("source:") for tag in tags):
+        missing.append("source tag")
+    if not any(tag.startswith(("repo:", "system:")) for tag in tags):
+        missing.append("target tag")
+    return missing
+
+
+def result(payload):
+    missing = missing_fields(payload)
+    if not missing:
+        return None
+    return {
+        "hookSpecificOutput": {
+            "hookEventName": "PreToolUse",
+            "permissionDecision": "deny",
+            "permissionDecisionReason": (
+                "Taiga item creation requires " + ", ".join(missing) +
+                ". Resolve or create the current WIB sprint first."
+            ),
+        }
+    }
+
+
+def main():
+    if sys.argv[1:] == ["--self-check"]:
+        assert result({"tool_input": {"assigned_to": 1, "milestone": 1,
+                                        "tags": ["infra", "source:codex", "repo:brain"]}}) is None
+        assert result({"tool_input": {"tags": []}})
+        print("self-check: ok")
+        return
+    output = result(json.load(sys.stdin))
+    if output:
+        print(json.dumps(output))
+
+
+if __name__ == "__main__":
+    main()