@amsterdamdatalabs/adl-agent-control-linux-x64 0.1.34 → 0.1.37

package/packages/agent-hooks/src/rules/impl/adl-git-user-override-block.ts

@@ -0,0 +1,159 @@
+/** `adl.git-user-override-block` — blanket deny (2026-10-12) of every `user.name` / `user.email` / `user.useConfigOnly` override on a git command: inline `-c user.*=…` / `--config-env user.*=…` (separated, bundled, or bare next-token), the `GIT_CONFIG_COUNT` / `GIT_CONFIG_KEY_<n>` / `GIT_CONFIG_VALUE_<n>` env-var equivalent, AND any `git config` invocation at all (read or write — the whole subcommand is closed; an agent that needs the current identity runs `git var GIT_AUTHOR_IDENT` or reads `.git/config` directly). The only allowed identity path is `ADL_AGENT_ID_AGENT=agent-tarun` on the command line so the front controller (`bin/git-ado`) stamps the right committer. Placed 3rd in `GIT_RULES`, right after the two `core.*` override rules, so a `user.*` ride-along on any subcommand reports as the user override, not the subcommand rule. The pre-commit hook (the `prepare-commit-msg` / `commit-msg` pair `bin/git-ado` calls) used to catch the *result* on `git commit`, but not on `git commit-tree` / `git fast-import` / etc. — this rule closes the gap at the command level, before git ever sees the override. */
+
+import { isHelpOnlyInvocation } from './git-helpers.ts'
+import type { Finding, MessageContext, RuleContext, RuleSpec } from '../spec.ts'
+import { noParams } from '../spec.ts'
+import { gitAgentTail } from './messages.ts'
+import type { Invocation } from '../shell/invocation.ts'
+import { tokenValue } from '../shell/token.ts'
+
+/** `user.name`, `user.email`, `user.useConfigOnly` — case-insensitive. */
+const USER_KEY = /^user\.(name|email|useconfigonly)\b/i
+
+/** `GIT_CONFIG_COUNT=<n>` where `<n>` is a non-zero integer — captured so the env-var form's scope gate (the COUNT must be non-zero for git to read any of the KEY/VALUE pairs) is enforced, not assumed. */
+const GIT_CONFIG_COUNT_RE = /\bGIT_CONFIG_COUNT\s*=\s*([1-9]\d*)\b/i
+/** `GIT_CONFIG_KEY_<n>=<value>` — `<value>` is checked against `USER_KEY` separately. */
+const GIT_CONFIG_KEY_RE = /\bGIT_CONFIG_KEY_\d+\s*=\s*([^\s'"`;&|<>(){}]+)/gi
+
+function gitInvocation(inv: Invocation): Invocation & { kind: 'git' } | null {
+  return inv.kind === 'git' ? inv : null
+}
+
+/** True when `tokens` (the post-`-c` value tokens) contains a `user.*` key; strips a single leading `-c` so the bundled `-cuser.name=Foo` form (whole-token consumed by `scanGitGlobals`) matches the same regex as the separated form. */
+function tokensOverrideUser(tokens: readonly { readonly value: string }[]): boolean {
+  for (const token of tokens) {
+    const raw = tokenValue(token as Parameters<typeof tokenValue>[0])
+    // Bundled `-cuser.name=Foo`: drop the leading `-c` so the regex below matches.
+    const value = raw.startsWith('-c') && raw.length > 2 ? raw.slice(2) : raw
+    if (USER_KEY.test(value)) return true
+  }
+  return false
+}
+
+/** True when `command` carries the `GIT_CONFIG_*` env-var form of a `user.*` override: a non-zero `GIT_CONFIG_COUNT=<n>` AND at least one `GIT_CONFIG_KEY_<n>=user.<…>` (both must be present; a lone KEY without a non-zero COUNT is a no-op and not a bypass). */
+function envVarOverrideUser(command: string): boolean {
+  if (!GIT_CONFIG_COUNT_RE.test(command)) return false
+  // Reset the shared `g`-flag regex's lastIndex between calls (stateful).
+  GIT_CONFIG_KEY_RE.lastIndex = 0
+  for (;;) {
+    const match = GIT_CONFIG_KEY_RE.exec(command)
+    if (match === null) return false
+    if (USER_KEY.test(match[1] as string)) return true
+  }
+}
+
+export const adlGitUserOverrideBlock: RuleSpec = {
+  id: 'adl.git-user-override-block',
+  category: 'git',
+  severity: 'deny',
+  enabledByDefault: true,
+  summary: 'Blanket deny (2026-10-12) of every `user.*` override on a git command: inline `-c` / `--config-env`, the `GIT_CONFIG_*` env-var equivalent, AND any `git config` invocation at all (read or write — the whole subcommand is closed; `git var GIT_AUTHOR_IDENT` is the only way an agent reads the current identity). The only allowed identity path is `ADL_AGENT_ID_AGENT=agent-tarun` on the command line.',
+  params: noParams,
+  match(inv, ctx: RuleContext<Record<string, never>>): Finding | null {
+    const git = gitInvocation(inv)
+    if (!git) return null
+    if (isHelpOnlyInvocation(git.rest)) return null
+    // Blanket inline-override surface: `-c user.*=…` / `--config-env user.*=…` (and the bare-token / bundled forms) land in `git.globals`.
+    if (tokensOverrideUser(git.globals)) {
+      return { ruleId: 'adl.git-user-override-block', severity: 'deny', detail: {} }
+    }
+    // Env-var form: `GIT_CONFIG_*` assignments are consumed by `walk()` before the `git` Invocation is built; scan the raw `ctx.command`.
+    if (ctx.command !== undefined && envVarOverrideUser(ctx.command)) {
+      return { ruleId: 'adl.git-user-override-block', severity: 'deny', detail: {} }
+    }
+    // Per the 2026-10-12 widening: `git config` is BANNED for agents — every invocation, read or write. An agent that needs to know the current `user.name` runs `git var GIT_AUTHOR_IDENT` or reads `.git/config` directly; `git config` of any kind is the surface that touches persisted config and is closed.
+    if (git.subcommand === 'config') {
+      return { ruleId: 'adl.git-user-override-block', severity: 'deny', detail: {} }
+    }
+    return null
+  },
+  message(_finding: Finding, ctx: MessageContext) {
+    return {
+      user:
+        'Blocked a user.name / user.email / user.useConfigOnly override on a git command. ' +
+        'Inline `-c user.*=…`, `--config-env user.*=`, `GIT_CONFIG_KEY_<n>=user.*` env-var overrides, AND any `git config` invocation are all banned in an agent session.',
+      agent:
+        'DENIED user-identity override on a git command. `git -c user.name=…` / `-c user.email=…` / ' +
+        '`--config-env user.*=…` (in every form — separated, bundled as `-cuser.*=…`, or bare ' +
+        '`-c user.* …`); the `GIT_CONFIG_COUNT=<n> GIT_CONFIG_KEY_<n>=user.* GIT_CONFIG_VALUE_<n>=…` ' +
+        'env-var form (per `git-config(1)`); AND `git config …` of any kind (read or write — the whole ' +
+        'subcommand is closed in an agent session) are blanket-denied in an agent session (2026-10-12). ' +
+        'The only allowed identity path is `ADL_AGENT_ID_AGENT=agent-tarun` on the command line: ' +
+        '`ADL_AGENT_ID_AGENT=agent-tarun git commit -m …` so the front controller (`bin/git-ado`) ' +
+        'stamps the right committer. To read the current identity, run `git var GIT_AUTHOR_IDENT` or ' +
+        'read `.git/config` directly — `git config` is NEVER the right answer in an agent session, ' +
+        `even as a one-shot. ${gitAgentTail(ctx.snippet)}`,
+    }
+  },
+  corpus: {
+    deny: [
+      // `-c user.*=` (separate token)
+      'git -c user.name=Foo commit -m x',
+      'git -c user.email=foo@bar commit -m x',
+      'git -c user.useConfigOnly=true commit -m x',
+      // `-c` bundled with `=` (no space) — the same form `scanGitGlobals` folds
+      'git -cuser.name=Foo commit -m x',
+      'git -cuser.email=foo@bar commit -m x',
+      // bare `-c` + separate-token value (next-token form)
+      'git -c user.name Foo commit -m x',
+      'git -c user.email foo@bar commit -m x',
+      // Case-insensitive
+      'git -c User.Name=Foo commit -m x',
+      'git -c USER.EMAIL=foo@bar commit -m x',
+      // `--config-env` (the env-var form, not just `-c`)
+      'git --config-env user.name=Foo commit -m x',
+      // `user.*` ride-along with a non-commit subcommand — still blocked (blanket)
+      'git -c user.name=Foo push',
+      'git -c user.name=Foo push origin main',
+      'git -c user.email=foo@bar fetch',
+      'git -c user.name=Foo log --oneline',
+      'git -c user.email=foo@bar status',
+      // The GIT_CONFIG_* env-var form — git's own alternative to `-c`; COUNT must be non-zero AND a KEY_<n>=user.* must be present for the bypass to take effect (the rule denies on that pair).
+      'GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=user.name GIT_CONFIG_VALUE_0=Foo git commit -m x',
+      'GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=user.email GIT_CONFIG_VALUE_0=foo@bar git commit -m x',
+      'GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=user.useConfigOnly GIT_CONFIG_VALUE_0=true git commit -m x',
+      // Same, riding along with a non-commit subcommand
+      'GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=user.name GIT_CONFIG_VALUE_0=Foo git push',
+      'GIT_CONFIG_COUNT=2 GIT_CONFIG_KEY_0=user.name GIT_CONFIG_VALUE_0=Foo GIT_CONFIG_KEY_1=user.email GIT_CONFIG_VALUE_1=foo@bar git commit -m x',
+      // Persistent form: `git config user.* …` (including `--global` / `--local` / `--unset` / `--remove-section user`).
+      'git config user.name "agent-tarun"',
+      'git config --global user.name "agent-tarun"',
+      'git config --local user.email "agent-tarun@<org-domain>"',
+      'git config user.useConfigOnly true',
+      'git config --unset user.name',
+      'git config --remove-section user',
+      'git config --remove-section-all user',
+      // Per the 2026-10-12 widening: every `git config` invocation is denied (read or write — the whole subcommand is closed; an agent that needs the current identity runs `git var GIT_AUTHOR_IDENT` or reads `.git/config` directly).
+      'git config --list',
+      'git config --list --local',
+      'git config --get user.name',
+      'git config --get-all user.email',
+      'git config --get-regexp "^user\\."',
+      'git config http.proxy http://proxy:8080',
+      'git config --global core.editor vim',
+      'git config --local init.defaultBranch main',
+    ],
+    allow: [
+      // ordinary git traffic, no user.* anywhere
+      'git status',
+      'git log --oneline',
+      'git commit -m "ordinary commit"',
+      // help invocations are exempted (the only thing in `rest` is a flag)
+      'git -c user.name=Foo --help',
+      // other `-c` keys ride along freely (inline-override surface is the rule, not all `-c` flags)
+      'git -c http.proxy=http://proxy:8080 clone https://github.com/foo/bar',
+      'git -c core.autocrlf=false commit -m x',
+      'git -c init.defaultBranch=main init',
+      // The legitimate identity path: prefix every commit with `ADL_AGENT_ID_AGENT=agent-tarun` so the front controller stamps the right committer. This is what the rule tells the agent to do.
+      'ADL_AGENT_ID_AGENT=agent-tarun git commit -m "an agent commit"',
+      // The legitimate identity read: `git var GIT_AUTHOR_IDENT` (NOT `git config --get user.name`).
+      'git var GIT_AUTHOR_IDENT',
+      // `GIT_CONFIG_*` with no `user.*` key — not a user-override. Agents may legitimately override `http.proxy` or `init.defaultBranch` via the env-var form.
+      'GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=http.proxy GIT_CONFIG_VALUE_0=http://proxy:8080 git clone https://github.com/foo/bar',
+      'GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=init.defaultBranch GIT_CONFIG_VALUE_0=main git init',
+      // `GIT_CONFIG_KEY_<n>=user.*` with no COUNT or COUNT=0 — git ignores the key without a non-zero count, so this is a no-op and not a bypass.
+      'GIT_CONFIG_KEY_0=user.name GIT_CONFIG_VALUE_0=Foo git commit -m x',
+      'GIT_CONFIG_COUNT=0 GIT_CONFIG_KEY_0=user.name GIT_CONFIG_VALUE_0=Foo git commit -m x',
+    ],
+  },
+}

package/packages/agent-hooks/src/rules/impl/adl-mcp-cli.ts

@@ -56,12 +56,12 @@ interface GatedCommand {
 /**
  * Only the flags a role rule actually inspects: `pr-create-or-update`'s
  * `--action`/`--auto-complete`/`--no-auto-complete`/`--merge-strategy`/
- * `--delete-source-branch` (`isPrCompletionCall`, pr-completion.ts) and
+ * `--delete-source-branch` (`isPrCompletionCall`, pr-completion.ts),
  * `pr-review`'s `--comment`/`--vote`/`--target-branch`
- * (`adl-pr-review-role.ts`). `workitem-create-or-update` and `build-run` are
- * graded on identity alone — no input field changes their outcome — so
- * their flag lists are empty; the command still needs an entry here so it is
- * RECOGNIZED at all.
+ * (`adl-pr-review-role.ts`), and `build-run`'s `--id`/`--branch`
+ * (`adl.build-run-role`). `workitem-create-or-update` is graded on identity
+ * alone — no input field changes its outcome — so its flag list is empty;
+ * every command still needs an entry here so it is RECOGNIZED at all.
  */
 const GATED_COMMANDS: Readonly<Record<string, GatedCommand>> = {
   'workitem-create-or-update': { tool: 'workitem_create_or_update', flags: [] },
@@ -83,7 +83,13 @@ const GATED_COMMANDS: Readonly<Record<string, GatedCommand>> = {
       { flag: '--target-branch', key: 'targetBranch', type: 'string' },
     ],
   },
-  'build-run': { tool: 'build_run', flags: [] },
+  'build-run': {
+    tool: 'build_run',
+    flags: [
+      { flag: '--id', key: 'id', type: 'integer' },
+      { flag: '--branch', key: 'branch', type: 'string' },
+    ],
+  },
 }
 
 /**

package/packages/agent-hooks/src/rules/impl/adl-pr-complete-pending.ts

@@ -1,9 +1,9 @@
 /**
  * `adl.pr-complete-pending-decision` — docs/operations/agent-permissions.md row 9
- * ("PR complete / set auto-complete"), marked **OPEN** in the matrix: denied
- * for BOTH `agent-tarun`/`agent-vivek` AND `agent-reviewer` "until Tarun
- * decides", as its own separately named rule specifically so it can be
- * relaxed (or given a real role split) without touching
+ * ("PR complete / set auto-complete"), DECIDED: denied for every identity —
+ * `agent-tarun`/`agent-vivek` AND `agent-reviewer` alike — as its own
+ * separately named rule specifically so the denial (or a future role split)
+ * can be relaxed without touching
  * `adl.pr-create-update-role` (row 5), which keeps allowing a plain PR
  * create/update for builders and `agent-reviewer` throughout
  * (docs/specs/two-branch-standard-2026-09-27.md §1b.5: auto-complete is armed
@@ -16,9 +16,9 @@
  * owner decision unrelated to this row, and denying that would block PR
  * creation entirely).
  *
- * Deliberately does NOT require an identity to be present: row 9 is OPEN
- * regardless of who is asking, including a caller with no session identity at
- * all (whichever rule reports first, the outcome is the same: denied).
+ * Deliberately does NOT require an identity to be present: row 9 denies
+ * EVERY identity, including a caller with no session identity at all
+ * (whichever rule reports first, the outcome is the same: denied).
  */
 
 import type { Invocation } from '../shell/invocation.ts'
@@ -36,7 +36,7 @@ export const adlPrCompletePendingDecision: RuleSpec = {
   severity: 'deny',
   enabledByDefault: true,
   summary:
-    'Deny PR completion / auto-complete for every identity — open decision (docs/operations/agent-permissions.md row 9) — the MCP tool AND its adl mcp cli equivalent.',
+    'Deny PR completion / auto-complete for every identity (docs/operations/agent-permissions.md row 9) — the MCP tool AND its adl mcp cli equivalent.',
   params: noParams,
   match(inv: Invocation): Finding | null {
     // `adl mcp cli
@@ -54,7 +54,7 @@ export const adlPrCompletePendingDecision: RuleSpec = {
     return {
       user,
       agent:
-        `DENIED ${user} (docs/operations/agent-permissions.md row 9, marked OPEN). Create or update the PR's title/description ` +
+        `DENIED ${user} (docs/operations/agent-permissions.md row 9: denied for every identity). Create or update the PR's title/description ` +
         `normally; do not pass autoComplete, mergeStrategy, or deleteSourceBranch. Blocked: ${ctx.snippet}`,
     }
   },

package/packages/agent-hooks/src/rules/impl/adl-pr-role.ts

@@ -34,11 +34,12 @@
  * regardless of who is asking, and the two rules never fight over the same
  * call.
  *
- * Rows 6 and 7 (PR comment; PR vote) are the same allow-set shape, but
- * `packages/azdo` has no comment/vote tool today — grepped 2026-09-27,
- * nothing named `pr_review`/`pr_comment`/`pr_vote` exists. PENDING: add a
- * sibling check here (or a new rule) when Stream B ships one, rather than
- * matching a guessed tool name now.
+ * Rows 6-8 (PR comment; PR vote on `main`; PR vote on `integration`) ship
+ * their own gate now: the sibling `adl-pr-review-role.ts` rules
+ * `pr_review` (shipped in `packages/azdo/src/azdo-pr-review.ts`, C3
+ * 2026-09-27) — comment allowed for the same allow-set as row 5, vote
+ * allowed for `agent-reviewer` only and only on `main`. This rule does not
+ * match `pr_review` at all; the two rules never fight over the same call.
  *
  * Requires an identity to already be present (`ADL_AGENT_ID_AGENT`
  * non-blank) — with no identity at all, `adl.run-required-for-writes`

package/packages/agent-hooks/src/rules/impl/agent-tamper-protection.ts

@@ -2,21 +2,22 @@
  * Editing the files that wire the host's hooks.
  *
  * Handoff 5, rule 5: deny Write/Edit/MultiEdit/NotebookEdit on
- * `.claude/settings.json`, `.claude/settings.local.json`, or
- * `.codex/config.toml`. These are the files that install the hook into the
- * host (including the `.local.json` overrides). Editing any of them is a way
- * to switch the gate off without anyone noticing.
+ * `.claude/settings.json`, `.claude/settings.local.json`,
+ * `.codex/config.toml`, or `adl-config.toml`. These are the files that
+ * install the hook into the host (including the `.local.json` overrides)
+ * or that the running hook reads on every call — editing any of them is a
+ * way to switch the gate off without anyone noticing.
  *
- * `adl-config.toml` was the fourth file until 2026-10-01 (Tarun: "nobody
- * should stop editing adl-config.toml"). It is no longer on the list, so an
- * agent can edit, move or delete it. Two things follow, both accepted by the
- * owner: (1) every hook run re-reads it, so `[hooks] enabled = false` (a
- * silent no-op, `main.ts`'s `runHook`) or a `[rules."<id>"] enabled = false`
- * takes effect on the agent's next tool call, ahead of any commit — the
- * commit-time layers (`git.protected-tree-commit`, repo-controls' integrity
- * gate) are the only review left; (2) the carriers that stayed on the list
- * below are only as strong as that file, since it can also switch THIS rule
- * off.
+ * `adl-config.toml` left the list on 2026-10-01 (Tarun: "nobody should
+ * stop editing adl-config.toml") and rejoined it on 2026-10-12, after a
+ * review-of-the-door confirmed the gap: every hook run re-reads it, so
+ * `[hooks] enabled = false` (a silent no-op, `main.ts`'s `runHook`) or a
+ * `[rules."<id>"] enabled = false` takes effect on the agent's next tool
+ * call, ahead of any commit. The commit-time layers
+ * (`git.protected-tree-commit`, repo-controls' integrity gate) fire on the
+ * COMMITTED file, not on the working-tree copy that the running hook
+ * reads. The carriers on the list below are only as strong as that file,
+ * since it can also switch THIS rule off.
  *
  * Hooks are local-repo-first (Tarun, 2026-09-29): there is no managed-hooks
  * lock and no global carrier, so these per-repo carrier files are the ONLY

package/packages/agent-hooks/src/rules/impl/git-core.ts

@@ -49,10 +49,9 @@ export const gitHooksPath: RuleSpec = {
       'git -c core.hooksPath=/dev/null commit -m x',
       'git -c core.hooksPath= push',
       'git -c core.hooksPath=/tmp/empty commit --amend',
-      'git config core.hooksPath /dev/null',
-      'git config --global core.hooksPath /tmp/empty',
     ],
-    allow: ['git stash --help', 'git config user.name t'],
+    // The `git config core.hooksPath …` positive controls were here for years — gone as of Bug 695 (2026-10-12): `adl.git-user-override-block` denies every `git config` invocation in the engine, so a `git config …` string is denied upstream and never exercises the `subcommand === 'config' && overridesHooksPath(git.rest)` branch (the `-c` deny entries above still cover the override surface).
+    allow: ['git stash --help'],
   },
 }
 
@@ -91,11 +90,8 @@ export const gitCoreBare: RuleSpec = {
     deny: [
       'git -c core.bare=true status',
       'git -c core.bare=false commit -m x',
-      'git config core.bare true',
-      'git config --bool core.bare true',
-      'git config --global core.bare true',
-      'git config --unset core.bare',
     ],
-    allow: ['git status', 'git config user.name t'],
+    // The `git config core.bare …` positive controls were here for years — gone as of Bug 695 (2026-10-12): `adl.git-user-override-block` denies every `git config` invocation in the engine, so a `git config …` string is denied upstream and never exercises the `subcommand === 'config' && flipsCoreBare(git.rest)` branch (the `-c` deny entries above still cover the override surface).
+    allow: ['git status'],
   },
 }

package/packages/agent-hooks/src/rules/impl/mcp-tool.ts

@@ -50,7 +50,7 @@ export function toolNameEndingWithKnownSuffix(tool: string, knownSuffixes: Reado
  *
  * Shared by every rule that gates an Azure DevOps MCP tool by name
  * (adl-run-required.ts, adl-pr-role.ts, adl-pr-complete-pending.ts,
- * adl-workitem-role.ts, adl-build-run-denied.ts) so the parsing cannot drift
+ * adl-workitem-role.ts, adl-build-run-role.ts) so the parsing cannot drift
  * between them.
  *
  * Prefix-less fallback (added 2026-09-28 with the one-agent-identity

package/packages/agent-hooks/src/rules/impl/tool-native-search.ts

@@ -56,13 +56,13 @@ export const toolNativeSearch: RuleSpec = {
   category: 'tool-call',
   severity: 'deny',
   enabledByDefault: true,
-  summary: 'Deny the native Grep/Glob/Search tools; steer at search <semantic query | keywords> (docs/plans), crg (code graph), rg, ast-grep.',
+  summary: 'Deny the native Grep/Glob/Search tools; steer at search <semantic query | keywords> (markdown), crg (code graph), rg, ast-grep.',
   params: noParams,
   match(inv: Invocation): Finding | null {
     if (inv.kind !== 'tool-call') return null
     if (!new Set(loadSurfacePolicy().deny.nativeTools).has(inv.tool)) return null
     // Surface the tool input's path-ish field for the message so it can
-    // recommend `search` (the right tool for docs/plans/.scratchpad) over
+    // recommend `search` (the right tool for markdown) over
     // `crg` (the right tool for code-graph queries). Different hosts name
     // this field differently — Claude uses `path`, Codex uses `path`,
     // Cursor uses `target_file` / `target_directory` for Write. The
@@ -77,10 +77,11 @@ export const toolNativeSearch: RuleSpec = {
   },
   message(finding: Finding, ctx: MessageContext) {
     const tool = typeof finding.detail.tool === 'string' ? finding.detail.tool : 'this tool'
-    // Path-aware recommendation. Native Grep on docs/plans/.scratchpad ->
-    // lead with `search`; everywhere else -> lead with `crg`.
+    // Path-aware recommendation. Native Grep on a markdown file (any
+    // docs/plans/.scratchpad tree or *.md path) -> lead with `search`;
+    // code -> lead with `crg`.
     const path = typeof finding.detail.path === 'string' ? finding.detail.path : ''
-    const isDoc = DOC_TREES.some((prefix) => path.startsWith(prefix))
+    const isDoc = DOC_TREES.some((prefix) => path.startsWith(prefix)) || path.endsWith('.md')
 
     const leadTool = isDoc ? 'search' : 'crg'
     const leadExamples = ALLOWED_SEARCH_TOOLS.find((row) => row.binary === leadTool)?.examples ?? []
@@ -93,8 +94,8 @@ export const toolNativeSearch: RuleSpec = {
 
     return {
       user: isDoc
-        ? `Blocked the native ${tool} tool on \`${path}\` (a docs/plans/.scratchpad tree). The right answer is \`search <semantic query | keywords>\` — semantic + keyword, finds the doc that *talks* about X. \`rg\`/\`crg\` are the wrong tools here.`
-        : `Blocked the native ${tool} tool. Lead with \`crg search "<text>"\` for code-graph queries, fall back to \`rg\`/\`ast-grep\` for literal text, \`search <semantic query | keywords>\` only when the path is docs/plans/.scratchpad.`,
+        ? `Blocked the native ${tool} tool on \`${path}\` (markdown). The right answer is \`search <semantic query | keywords>\` — semantic + keyword, finds the doc that *talks* about X, in any markdown file. \`rg\`/\`crg\` are the wrong tools here.`
+        : `Blocked the native ${tool} tool. Lead with \`crg search "<text>"\` for code-graph queries, fall back to \`rg\`/\`ast-grep\` for literal text, \`search <semantic query | keywords>\` for any markdown file.`,
       agent:
         `DENIED the native ${tool} tool. It is routed through the lean-ctx hook but NOT converted — ` +
         'the call still runs natively — so it is a way around the shell search ban rather than an ' +

package/packages/agent-hooks/src/rules/registry.ts

@@ -25,6 +25,7 @@ import type { AnyRuleSpec, RuleId } from './spec.ts'
 import { asAnyRuleSpec, corpusIsEmpty } from './spec.ts'
 
 import { gitHooksPath, gitCoreBare } from './impl/git-core.ts'
+import { adlGitUserOverrideBlock } from './impl/adl-git-user-override-block.ts'
 import { gitStash, gitClean, gitRebase, gitFilterBranch, gitRestore, gitReset, gitUpdateIndex } from './impl/git-transitions.ts'
 import { gitNoVerify, gitAmend } from './impl/git-verify.ts'
 import { gitProtectedTreeCommit } from './impl/git-protected-tree.ts'
@@ -63,7 +64,7 @@ import { adlPrCreateUpdateRole } from './impl/adl-pr-role.ts'
 import { adlPrReviewRole } from './impl/adl-pr-review-role.ts'
 import { adlPrCompletePendingDecision } from './impl/adl-pr-complete-pending.ts'
 import { adlWorkitemRequiresTarunOrVivek } from './impl/adl-workitem-role.ts'
-import { adlBuildRunDenied } from './impl/adl-build-run-denied.ts'
+import { adlBuildRunRole } from './impl/adl-build-run-role.ts'
 import { toolFind } from './impl/tool-find.ts'
 import { toolGrep } from './impl/tool-grep.ts'
 import { toolNativeSearch } from './impl/tool-native-search.ts'
@@ -85,6 +86,14 @@ import { agentTamperProtection } from './impl/agent-tamper-protection.ts'
 export const GIT_RULES: readonly AnyRuleSpec[] = [
   gitHooksPath,
   gitCoreBare,
+  // Right after the `core.*` override rules: a `user.*` override rides
+  // along with any subcommand via `-c user.*=`, exactly the way
+  // `core.hooksPath` / `core.bare` do — a `git -c user.name=human commit`
+  // / `push` should be reported as the user override, not whatever
+  // commit/push policy would otherwise report. The user's call (2026-10-12)
+  // is "no use of git -c user* at all … blanket ban for agents"; see
+  // CONTRIBUTING.md line 18 and INVARIANTS.md line 55.
+  adlGitUserOverrideBlock,
   gitStash,
   gitClean,
   gitRebase,
@@ -150,7 +159,7 @@ export const TOOL_RULES: readonly AnyRuleSpec[] = [
   adlPrReviewRole,
   adlPrCompletePendingDecision,
   adlWorkitemRequiresTarunOrVivek,
-  adlBuildRunDenied,
+  adlBuildRunRole,
 ].map(
   asAnyRuleSpec,
 )

package/packages/agent-hooks/src/rules/shell/protected-carriers.ts

@@ -29,10 +29,14 @@ export const PROTECTED_CARRIER_PATHS: ReadonlySet<string> = new Set([
   '.claude/settings.json',
   '.claude/settings.local.json',
   '.codex/config.toml',
-  // `adl-config.toml` was the fourth entry until 2026-10-01 (Tarun: "nobody
-  // should stop editing adl-config.toml"). It stays human-landed at commit time
-  // (`git.protected-tree-commit`, repo-controls' integrity gate), but an agent
-  // can now write it, and every hook run re-reads it.
+  // `adl-config.toml` is the repo's hook switch — every hook run re-reads it,
+  // so an agent that writes `[hooks] enabled = false` or disables any rule
+  // flips the gate off before the next tool call lands. Re-listed here on
+  // 2026-10-12 (Tarun: "we left a door open, close it"). The earlier
+  // 'human-only at commit time' assumption was wrong: the commit-time gate
+  // fires for the COMMITTED file, not for edits that never stage, and the
+  // working-tree copy is what every running hook reads.
+  'adl-config.toml',
   '.codex/hooks.json',
   '.cursor/hooks.json',
   '.opencode/plugins/adl-repo.ts',
@@ -142,7 +146,7 @@ const PROTECTED_CARRIER_DIRS: ReadonlySet<string> = new Set([
  *
  * `path` ending in a literal
  * `/` (BEFORE normalization strips it for the comparison itself) means "a
- * file goes INTO this directory" (`cp GLOBAL-AGENTS.md .claude/`, `mv
+ * file goes INTO this directory" (`cp TARUN-GLOBAL-AGENTS-INSTRUCTIONS.md .claude/`, `mv
  * notes.md .cursor/`) — the directory itself is untouched, only gaining an
  * unrelated file — never "this directory is the thing being moved/
  * overwritten" (`mv .claude .claude-old`, `mv attacker-stuff .codex` — no

package/packages/agent-settings/README.md

@@ -90,7 +90,7 @@ the built-in target allowlist.
 Ownership rule: machine-global agent configuration belongs to enact-vps;
 everything else belongs in the owning repository. The sweep therefore treats
 anything not declared by enact-vps (`protected.json`, the Kimi managed block,
-GLOBAL-AGENTS deployment targets) as foreign:
+global-agents deployment targets) as foreign:
 
 - JSON entries: Claude `settings.json` `hooks`, `mcpServers`, `enabledPlugins`,
   `extraKnownMarketplaces`, `permissions.allow|deny|ask` items; `.claude.json`
@@ -239,13 +239,13 @@ purpose even though it is a real, documented key, so the whole container
 stays a sweep candidate whenever non-empty — see the `reason` field on that
 baseline entry for the specific rationale.
 
-## Global agent instructions (`GLOBAL-AGENTS.md`)
+## Global agent instructions (`TARUN-GLOBAL-AGENTS-INSTRUCTIONS.md`)
 
-[`GLOBAL-AGENTS.md`](./assets/GLOBAL-AGENTS.md) is the single source of truth for
+[`TARUN-GLOBAL-AGENTS-INSTRUCTIONS.md`](./assets/TARUN-GLOBAL-AGENTS-INSTRUCTIONS.md) is the single source of truth for
 every host's global instruction file: `~/.claude/CLAUDE.md`,
 `~/.codex/AGENTS.md`, `~/.cursor/AGENTS.md`, `~/.kimi-code/AGENTS.md`, and
 `~/.config/opencode/AGENTS.md`. Any change to those files must be made in
-`GLOBAL-AGENTS.md`; a direct edit to a target is drift and is overwritten on
+`TARUN-GLOBAL-AGENTS-INSTRUCTIONS.md`; a direct edit to a target is drift and is overwritten on
 the next deploy.
 
 ```bash
@@ -254,6 +254,12 @@ bin/global-agents --home "$HOME" --mode deploy     # forced
 bin/global-agents --home "$HOME" --mode uninstall
 ```
 
+Deploy and status run only on Tarun's fleet (Tarun, 2026-10-10): the device
+name is the first label of the hostname (or `--host NAME`), and it must be a
+`mac.devices` or `linux.devices` key in `packages/fleet/manifest.json`.
+Any other machine writes no global file and prints one `skipped:` line saying
+why; existing files there are left alone, and uninstall is not gated.
+
 Deploy is always forced; there is no `--force` flag and no leave-in-place
 mode. A missing target is created, a target already equal to the source is
 left untouched, and a drifted target (hand-edited, or stale from an older

package/packages/agent-settings/assets/TARUN-GLOBAL-AGENTS-INSTRUCTIONS.md

@@ -0,0 +1,40 @@
+# Tarun's global agent instructions
+
+My personal preferences, for every agent on every machine I own, for coding and non-coding work alike.
+Where a repository has its own AGENTS.md, that file and the files it links add the repository's rules. They never relax Truthfulness, Verification before claiming done or Scope discipline here; on any other conflict, ask.
+
+## Communication
+- Address me as **Tarun**.
+- **Answer first.** No greeting, no "let me", no recap of what was just done, no closers.
+- One idea per sentence. Short beats polite. Articles can go; not, never, no, only never do. Numbers, paths, commands exact.
+- Bullet points over prose.
+- **Open points:** one numbered list of open decisions per conversation. Show it only when it changes — item added or resolved. After a long gap or compaction, restate the full list. That is when it gets lost.
+- **Questions:** one at a time, one or two sentences. Options inline: `A) … B) …`. A long multi-part question means split the work, not more prose.
+- Full sentences for security warnings, irreversible actions, step-by-step orders, and when I'm confused. Then short resumes.
+- No performance. If short phrasing isn't shorter, plain English wins. Never rewrite my prompts.
+
+## Truthfulness (non-negotiable)
+- Never present something as done, working or checked when it is not. A failure reported plainly is worth more than a success that is not real.
+- **No silent fallback or degrade** — if the real path fails, say so loudly and stop.
+- **No silent drops** — no skipped steps, ignored errors or quietly narrowed scope.
+- **No fakes** — no placeholders, stand-ins or TODOs passed off as finished.
+- Unverified claims never enter anything that lasts: documents, messages, notes, memory.
+- Never read secret stores or credential files, never pass a token or password in a command or message, and never claim to be me or set anything that marks the session as human (drafting in my name when I ask is fine).
+
+## Verification before claiming done
+- **Evidence over assertions:** show what you ran or read, and make the check falsifiable ("did you search the source?" has an answer; "did you verify?" does not).
+- **A search shows what was returned, not what exists.** Before saying something is absent, say how you looked, and run a control search the same way for something you know is there. Search wide first, then narrow. No hits for both means you searched the wrong place.
+- **Ask the authoritative source, not the one in front of you:** the original over a copy, the live system over a description of it.
+- **Re-check before reporting.** Cite the check you are reporting, not one you remember. Never claim "checked everything" without checking every case.
+- A requirement you are about to not meet is a **stop**: tell me; never quietly decide to skip it.
+
+## Scope discipline
+- Work in your own working directory. Touch only what is in scope: the files, accounts, people and systems the task names.
+- Anything outside scope is raised as an open point for me (or recorded where that work is tracked): never silently done, never silently dropped.
+
+## Delegation & parallelism
+- Where the surface supports helper agents, the main agent orchestrates and verifies and helpers do the hands-on work; small tasks may be done directly.
+- Split independent work into **concurrent agents** launched together — never sequential when it can fan out.
+- Match the model to the task: strongest for deep analysis and judgment, fastest for quick lookups.
+- Author and reviewer are **distinct passes in separate contexts**. Never self-approve.
+- Prefer speed through parallel runs and fast models; never skip verification for speed.