@amsterdamdatalabs/adl-agent-control-linux-x64 0.1.35 → 0.1.37

package/bin/adl

@@ -1,4 +1,4 @@
 [diffend] Oversized file quarantined before diffing.
 name: package/bin/adl
-size: 82949600 bytes
-sha256: 42e867b263b1cb13e200275f93036ccdaca15e3902ed11b60efbdea3730d96a3
+size: 82998752 bytes
+sha256: a9c4655905b5f4b937f9d93dadeb7ad5ae28dec1392a767225242478684aff98

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amsterdamdatalabs/adl-agent-control-linux-x64",
-  "version": "0.1.35",
+  "version": "0.1.37",
   "description": "adl CLI binary for linux/x64 (agent identity + Azure DevOps front door — see docs/architecture/cli-design.md)",
   "license": "UNLICENSED",
   "os": [

package/packages/agent-hooks/deploy-profile.json

@@ -40,7 +40,7 @@
       "file": ".opencode/plugins/adl-repo.ts",
       "hostSuffix": "opencode",
       "matchers": {
-        "Bash": "bash",
+        "Bash": "bash|shell",
         "Write|Edit|MultiEdit|StrReplace|str_replace_editor|edit_file|str_replace|replace_in_file|create_file|write_file": "write|edit"
       },
       "unmappedMatcher": "keep",

package/packages/agent-hooks/src/pre-tool-use/handler.ts

@@ -284,7 +284,7 @@ const IDENTITY_RULE_IDS: ReadonlySet<RuleId> = new Set([
  * The four role-gate rules that deny a SPECIFIC Azure DevOps MCP tool call by
  * the caller's identity (`adl.workitem-requires-tarun-or-vivek`,
  * `adl.pr-create-update-role`, `adl.pr-review-role`,
- * `adl.build-run-denied`). None of these are in `IDENTITY_RULE_IDS` above —
+ * `adl.build-run-role`). None of these are in `IDENTITY_RULE_IDS` above —
  * that set covers the rules that fire when no identity is resolved or
  * carried, never a rule that denies WITH an identity already resolved, on the
  * strength of who that identity is. Each of them can only fire on the same
@@ -297,7 +297,7 @@ const ROLE_GATE_RULE_IDS: ReadonlySet<RuleId> = new Set([
   'adl.workitem-requires-tarun-or-vivek',
   'adl.pr-create-update-role',
   'adl.pr-review-role',
-  'adl.build-run-denied',
+  'adl.build-run-role',
 ])
 
 type IdentitySourceLabel = 'inline' | 'env' | 'default-file' | 'none'

package/packages/agent-hooks/src/rules/impl/adl-build-run-role.ts

@@ -0,0 +1,116 @@
+/** `adl.build-run-role` — docs/operations/agent-permissions.md row 12 (build run), decision H1; the allow condition and the caller-declared id-is-its-own-PR-validation-build approximation (hook has no network; azdo core must re-verify) are documented on match() below and in the summary. */
+
+import type { Invocation } from '../shell/invocation.ts'
+import type { Finding, MessageContext, RuleContext, RuleSpec } from '../spec.ts'
+import { noParams } from '../spec.ts'
+import { BRANCH_PREFIXES } from '../../../../azdo/src/lib/commit-types.ts'
+import { BUILDER_AGENTS, resolveFromEnvOrFile } from './adl-identity.ts'
+import { detailString } from './messages.ts'
+import { mcpToolName } from './mcp-tool.ts'
+import { effectiveIdentityForMcpCli, toolCallFor } from './adl-mcp-cli.ts'
+
+const RULE_ID = 'adl.build-run-role'
+
+const PROTECTED_BRANCHES: ReadonlySet<string> = new Set(['integration', 'main'])
+const FEATURE_PREFIXES: readonly string[] = BRANCH_PREFIXES.map((prefix) => `${prefix}/`)
+
+type Violation = 'not-a-builder' | 'missing-id' | 'missing-branch' | 'non-feature-branch'
+
+function normalizeBranchRef(ref: string): string {
+  return ref.startsWith('refs/heads/') ? ref.slice('refs/heads/'.length) : ref
+}
+
+function isFeatureBranchName(branch: string): boolean {
+  return FEATURE_PREFIXES.some((prefix) => branch.startsWith(prefix))
+}
+
+export const adlBuildRunRole: RuleSpec = {
+  id: RULE_ID,
+  category: 'tool-call',
+  severity: 'deny',
+  enabledByDefault: true,
+  summary:
+    'Deny build_run except the lead (agent-tarun/agent-vivek) re-queuing its own PR’s validation pipeline on that PR’s feature branch (docs/operations/agent-permissions.md row 12, H1) — the MCP tool AND its adl mcp cli equivalent.',
+  params: noParams,
+  match(inv: Invocation, ctx: RuleContext<Record<string, never>>): Finding | null {
+    // Also catch `adl mcp cli build-run` — same tool, same grade.
+    const call = toolCallFor(inv)
+    if (call === null) return null
+    if (mcpToolName(call.tool) !== 'build_run') return null
+
+    // Grade the EFFECTIVE identity for THIS call — an inline ADL_AGENT_ID_AGENT= override on the same CLI invocation wins, like the other role rules.
+    const resolution = resolveFromEnvOrFile(ctx.env)
+    const fallback = resolution.ok ? resolution.agent : null
+    const agent = effectiveIdentityForMcpCli(inv, ctx.command ?? '', fallback)
+    if (agent === null) return null // no identity at all: adl.run-required-for-writes's job
+
+    // 1. Only the lead re-queues CI — the role mismatch reports first regardless of shape.
+    if (!BUILDER_AGENTS.has(agent)) {
+      return { ruleId: RULE_ID, severity: 'deny', detail: { tool: call.tool, violation: 'not-a-builder' satisfies Violation } }
+    }
+
+    // 2. The definition id, validated exactly like azdo-pl.ts's buildRun (a positive integer).
+    const id = call.input.id
+    if (typeof id !== 'number' || !Number.isInteger(id) || id < 1) {
+      return { ruleId: RULE_ID, severity: 'deny', detail: { tool: call.tool, violation: 'missing-id' satisfies Violation } }
+    }
+
+    // 3. The PR source branch, caller-declared exactly like pr_review's targetBranch: required, and provably a feature branch.
+    const branch = call.input.branch
+    if (typeof branch !== 'string' || branch.trim().length === 0) {
+      return { ruleId: RULE_ID, severity: 'deny', detail: { tool: call.tool, violation: 'missing-branch' satisfies Violation } }
+    }
+    const normalized = normalizeBranchRef(branch.trim())
+    if (PROTECTED_BRANCHES.has(normalized) || !isFeatureBranchName(normalized)) {
+      return { ruleId: RULE_ID, severity: 'deny', detail: { tool: call.tool, violation: 'non-feature-branch' satisfies Violation } }
+    }
+
+    return null
+  },
+  message(finding: Finding, ctx: MessageContext) {
+    const tool = detailString(finding, 'tool')
+    const violation = detailString(finding, 'violation') as Violation
+
+    if (violation === 'not-a-builder') {
+      const user = 'this operation can only be done with agent-tarun or agent-vivek'
+      return {
+        user,
+        agent:
+          `DENIED ${tool}: ${user}. Only the lead may re-queue its own PR’s validation pipeline on that PR’s ` +
+          `source branch — agent-reviewer runs no implementation PRs, so it has no PR CI to re-queue. Blocked: ${ctx.snippet}`,
+      }
+    }
+
+    if (violation === 'missing-id') {
+      const user = 'a build definition id is required'
+      return {
+        user,
+        agent: `DENIED ${tool}: ${user} — pass the definition id of your PR’s validation pipeline (a positive integer). Blocked: ${ctx.snippet}`,
+      }
+    }
+
+    if (violation === 'missing-branch') {
+      const user = 'name the source branch of your own PR to re-queue its validation pipeline'
+      return {
+        user,
+        agent:
+          `DENIED ${tool}: ${user}. The branch argument is what lets this hook scope the re-queue to your own ` +
+          `PR’s CI — without it, pipelines run on their own triggers. Re-queue with \`branch\` naming your PR’s ` +
+          `feature branch. Blocked: ${ctx.snippet}`,
+      }
+    }
+
+    const user = 'only a feature branch that is your own PR’s source branch may be re-queued'
+    return {
+      user,
+      agent:
+        `DENIED ${tool}: ${user}. \`integration\`/\`main\` and every unrecognized branch name are denied — a PR’s ` +
+        `source branch always carries a \`${FEATURE_PREFIXES.join(' ')}\` prefix. Blocked: ${ctx.snippet}`,
+    }
+  },
+  corpus: {
+    // Tool-call rule; real coverage is tests/unit/rules-adl-build-run-role.test.ts (the shared shell corpus only proves non-firing on unrelated commands).
+    deny: [],
+    allow: ['ls -la', 'git status'],
+  },
+}

package/packages/agent-hooks/src/rules/impl/adl-git-user-override-block.ts

@@ -0,0 +1,159 @@
+/** `adl.git-user-override-block` — blanket deny (2026-10-12) of every `user.name` / `user.email` / `user.useConfigOnly` override on a git command: inline `-c user.*=…` / `--config-env user.*=…` (separated, bundled, or bare next-token), the `GIT_CONFIG_COUNT` / `GIT_CONFIG_KEY_<n>` / `GIT_CONFIG_VALUE_<n>` env-var equivalent, AND any `git config` invocation at all (read or write — the whole subcommand is closed; an agent that needs the current identity runs `git var GIT_AUTHOR_IDENT` or reads `.git/config` directly). The only allowed identity path is `ADL_AGENT_ID_AGENT=agent-tarun` on the command line so the front controller (`bin/git-ado`) stamps the right committer. Placed 3rd in `GIT_RULES`, right after the two `core.*` override rules, so a `user.*` ride-along on any subcommand reports as the user override, not the subcommand rule. The pre-commit hook (the `prepare-commit-msg` / `commit-msg` pair `bin/git-ado` calls) used to catch the *result* on `git commit`, but not on `git commit-tree` / `git fast-import` / etc. — this rule closes the gap at the command level, before git ever sees the override. */
+
+import { isHelpOnlyInvocation } from './git-helpers.ts'
+import type { Finding, MessageContext, RuleContext, RuleSpec } from '../spec.ts'
+import { noParams } from '../spec.ts'
+import { gitAgentTail } from './messages.ts'
+import type { Invocation } from '../shell/invocation.ts'
+import { tokenValue } from '../shell/token.ts'
+
+/** `user.name`, `user.email`, `user.useConfigOnly` — case-insensitive. */
+const USER_KEY = /^user\.(name|email|useconfigonly)\b/i
+
+/** `GIT_CONFIG_COUNT=<n>` where `<n>` is a non-zero integer — captured so the env-var form's scope gate (the COUNT must be non-zero for git to read any of the KEY/VALUE pairs) is enforced, not assumed. */
+const GIT_CONFIG_COUNT_RE = /\bGIT_CONFIG_COUNT\s*=\s*([1-9]\d*)\b/i
+/** `GIT_CONFIG_KEY_<n>=<value>` — `<value>` is checked against `USER_KEY` separately. */
+const GIT_CONFIG_KEY_RE = /\bGIT_CONFIG_KEY_\d+\s*=\s*([^\s'"`;&|<>(){}]+)/gi
+
+function gitInvocation(inv: Invocation): Invocation & { kind: 'git' } | null {
+  return inv.kind === 'git' ? inv : null
+}
+
+/** True when `tokens` (the post-`-c` value tokens) contains a `user.*` key; strips a single leading `-c` so the bundled `-cuser.name=Foo` form (whole-token consumed by `scanGitGlobals`) matches the same regex as the separated form. */
+function tokensOverrideUser(tokens: readonly { readonly value: string }[]): boolean {
+  for (const token of tokens) {
+    const raw = tokenValue(token as Parameters<typeof tokenValue>[0])
+    // Bundled `-cuser.name=Foo`: drop the leading `-c` so the regex below matches.
+    const value = raw.startsWith('-c') && raw.length > 2 ? raw.slice(2) : raw
+    if (USER_KEY.test(value)) return true
+  }
+  return false
+}
+
+/** True when `command` carries the `GIT_CONFIG_*` env-var form of a `user.*` override: a non-zero `GIT_CONFIG_COUNT=<n>` AND at least one `GIT_CONFIG_KEY_<n>=user.<…>` (both must be present; a lone KEY without a non-zero COUNT is a no-op and not a bypass). */
+function envVarOverrideUser(command: string): boolean {
+  if (!GIT_CONFIG_COUNT_RE.test(command)) return false
+  // Reset the shared `g`-flag regex's lastIndex between calls (stateful).
+  GIT_CONFIG_KEY_RE.lastIndex = 0
+  for (;;) {
+    const match = GIT_CONFIG_KEY_RE.exec(command)
+    if (match === null) return false
+    if (USER_KEY.test(match[1] as string)) return true
+  }
+}
+
+export const adlGitUserOverrideBlock: RuleSpec = {
+  id: 'adl.git-user-override-block',
+  category: 'git',
+  severity: 'deny',
+  enabledByDefault: true,
+  summary: 'Blanket deny (2026-10-12) of every `user.*` override on a git command: inline `-c` / `--config-env`, the `GIT_CONFIG_*` env-var equivalent, AND any `git config` invocation at all (read or write — the whole subcommand is closed; `git var GIT_AUTHOR_IDENT` is the only way an agent reads the current identity). The only allowed identity path is `ADL_AGENT_ID_AGENT=agent-tarun` on the command line.',
+  params: noParams,
+  match(inv, ctx: RuleContext<Record<string, never>>): Finding | null {
+    const git = gitInvocation(inv)
+    if (!git) return null
+    if (isHelpOnlyInvocation(git.rest)) return null
+    // Blanket inline-override surface: `-c user.*=…` / `--config-env user.*=…` (and the bare-token / bundled forms) land in `git.globals`.
+    if (tokensOverrideUser(git.globals)) {
+      return { ruleId: 'adl.git-user-override-block', severity: 'deny', detail: {} }
+    }
+    // Env-var form: `GIT_CONFIG_*` assignments are consumed by `walk()` before the `git` Invocation is built; scan the raw `ctx.command`.
+    if (ctx.command !== undefined && envVarOverrideUser(ctx.command)) {
+      return { ruleId: 'adl.git-user-override-block', severity: 'deny', detail: {} }
+    }
+    // Per the 2026-10-12 widening: `git config` is BANNED for agents — every invocation, read or write. An agent that needs to know the current `user.name` runs `git var GIT_AUTHOR_IDENT` or reads `.git/config` directly; `git config` of any kind is the surface that touches persisted config and is closed.
+    if (git.subcommand === 'config') {
+      return { ruleId: 'adl.git-user-override-block', severity: 'deny', detail: {} }
+    }
+    return null
+  },
+  message(_finding: Finding, ctx: MessageContext) {
+    return {
+      user:
+        'Blocked a user.name / user.email / user.useConfigOnly override on a git command. ' +
+        'Inline `-c user.*=…`, `--config-env user.*=`, `GIT_CONFIG_KEY_<n>=user.*` env-var overrides, AND any `git config` invocation are all banned in an agent session.',
+      agent:
+        'DENIED user-identity override on a git command. `git -c user.name=…` / `-c user.email=…` / ' +
+        '`--config-env user.*=…` (in every form — separated, bundled as `-cuser.*=…`, or bare ' +
+        '`-c user.* …`); the `GIT_CONFIG_COUNT=<n> GIT_CONFIG_KEY_<n>=user.* GIT_CONFIG_VALUE_<n>=…` ' +
+        'env-var form (per `git-config(1)`); AND `git config …` of any kind (read or write — the whole ' +
+        'subcommand is closed in an agent session) are blanket-denied in an agent session (2026-10-12). ' +
+        'The only allowed identity path is `ADL_AGENT_ID_AGENT=agent-tarun` on the command line: ' +
+        '`ADL_AGENT_ID_AGENT=agent-tarun git commit -m …` so the front controller (`bin/git-ado`) ' +
+        'stamps the right committer. To read the current identity, run `git var GIT_AUTHOR_IDENT` or ' +
+        'read `.git/config` directly — `git config` is NEVER the right answer in an agent session, ' +
+        `even as a one-shot. ${gitAgentTail(ctx.snippet)}`,
+    }
+  },
+  corpus: {
+    deny: [
+      // `-c user.*=` (separate token)
+      'git -c user.name=Foo commit -m x',
+      'git -c user.email=foo@bar commit -m x',
+      'git -c user.useConfigOnly=true commit -m x',
+      // `-c` bundled with `=` (no space) — the same form `scanGitGlobals` folds
+      'git -cuser.name=Foo commit -m x',
+      'git -cuser.email=foo@bar commit -m x',
+      // bare `-c` + separate-token value (next-token form)
+      'git -c user.name Foo commit -m x',
+      'git -c user.email foo@bar commit -m x',
+      // Case-insensitive
+      'git -c User.Name=Foo commit -m x',
+      'git -c USER.EMAIL=foo@bar commit -m x',
+      // `--config-env` (the env-var form, not just `-c`)
+      'git --config-env user.name=Foo commit -m x',
+      // `user.*` ride-along with a non-commit subcommand — still blocked (blanket)
+      'git -c user.name=Foo push',
+      'git -c user.name=Foo push origin main',
+      'git -c user.email=foo@bar fetch',
+      'git -c user.name=Foo log --oneline',
+      'git -c user.email=foo@bar status',
+      // The GIT_CONFIG_* env-var form — git's own alternative to `-c`; COUNT must be non-zero AND a KEY_<n>=user.* must be present for the bypass to take effect (the rule denies on that pair).
+      'GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=user.name GIT_CONFIG_VALUE_0=Foo git commit -m x',
+      'GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=user.email GIT_CONFIG_VALUE_0=foo@bar git commit -m x',
+      'GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=user.useConfigOnly GIT_CONFIG_VALUE_0=true git commit -m x',
+      // Same, riding along with a non-commit subcommand
+      'GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=user.name GIT_CONFIG_VALUE_0=Foo git push',
+      'GIT_CONFIG_COUNT=2 GIT_CONFIG_KEY_0=user.name GIT_CONFIG_VALUE_0=Foo GIT_CONFIG_KEY_1=user.email GIT_CONFIG_VALUE_1=foo@bar git commit -m x',
+      // Persistent form: `git config user.* …` (including `--global` / `--local` / `--unset` / `--remove-section user`).
+      'git config user.name "agent-tarun"',
+      'git config --global user.name "agent-tarun"',
+      'git config --local user.email "agent-tarun@<org-domain>"',
+      'git config user.useConfigOnly true',
+      'git config --unset user.name',
+      'git config --remove-section user',
+      'git config --remove-section-all user',
+      // Per the 2026-10-12 widening: every `git config` invocation is denied (read or write — the whole subcommand is closed; an agent that needs the current identity runs `git var GIT_AUTHOR_IDENT` or reads `.git/config` directly).
+      'git config --list',
+      'git config --list --local',
+      'git config --get user.name',
+      'git config --get-all user.email',
+      'git config --get-regexp "^user\\."',
+      'git config http.proxy http://proxy:8080',
+      'git config --global core.editor vim',
+      'git config --local init.defaultBranch main',
+    ],
+    allow: [
+      // ordinary git traffic, no user.* anywhere
+      'git status',
+      'git log --oneline',
+      'git commit -m "ordinary commit"',
+      // help invocations are exempted (the only thing in `rest` is a flag)
+      'git -c user.name=Foo --help',
+      // other `-c` keys ride along freely (inline-override surface is the rule, not all `-c` flags)
+      'git -c http.proxy=http://proxy:8080 clone https://github.com/foo/bar',
+      'git -c core.autocrlf=false commit -m x',
+      'git -c init.defaultBranch=main init',
+      // The legitimate identity path: prefix every commit with `ADL_AGENT_ID_AGENT=agent-tarun` so the front controller stamps the right committer. This is what the rule tells the agent to do.
+      'ADL_AGENT_ID_AGENT=agent-tarun git commit -m "an agent commit"',
+      // The legitimate identity read: `git var GIT_AUTHOR_IDENT` (NOT `git config --get user.name`).
+      'git var GIT_AUTHOR_IDENT',
+      // `GIT_CONFIG_*` with no `user.*` key — not a user-override. Agents may legitimately override `http.proxy` or `init.defaultBranch` via the env-var form.
+      'GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=http.proxy GIT_CONFIG_VALUE_0=http://proxy:8080 git clone https://github.com/foo/bar',
+      'GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=init.defaultBranch GIT_CONFIG_VALUE_0=main git init',
+      // `GIT_CONFIG_KEY_<n>=user.*` with no COUNT or COUNT=0 — git ignores the key without a non-zero count, so this is a no-op and not a bypass.
+      'GIT_CONFIG_KEY_0=user.name GIT_CONFIG_VALUE_0=Foo git commit -m x',
+      'GIT_CONFIG_COUNT=0 GIT_CONFIG_KEY_0=user.name GIT_CONFIG_VALUE_0=Foo git commit -m x',
+    ],
+  },
+}

package/packages/agent-hooks/src/rules/impl/adl-mcp-cli.ts

@@ -56,12 +56,12 @@ interface GatedCommand {
 /**
  * Only the flags a role rule actually inspects: `pr-create-or-update`'s
  * `--action`/`--auto-complete`/`--no-auto-complete`/`--merge-strategy`/
- * `--delete-source-branch` (`isPrCompletionCall`, pr-completion.ts) and
+ * `--delete-source-branch` (`isPrCompletionCall`, pr-completion.ts),
  * `pr-review`'s `--comment`/`--vote`/`--target-branch`
- * (`adl-pr-review-role.ts`). `workitem-create-or-update` and `build-run` are
- * graded on identity alone — no input field changes their outcome — so
- * their flag lists are empty; the command still needs an entry here so it is
- * RECOGNIZED at all.
+ * (`adl-pr-review-role.ts`), and `build-run`'s `--id`/`--branch`
+ * (`adl.build-run-role`). `workitem-create-or-update` is graded on identity
+ * alone — no input field changes its outcome — so its flag list is empty;
+ * every command still needs an entry here so it is RECOGNIZED at all.
  */
 const GATED_COMMANDS: Readonly<Record<string, GatedCommand>> = {
   'workitem-create-or-update': { tool: 'workitem_create_or_update', flags: [] },
@@ -83,7 +83,13 @@ const GATED_COMMANDS: Readonly<Record<string, GatedCommand>> = {
       { flag: '--target-branch', key: 'targetBranch', type: 'string' },
     ],
   },
-  'build-run': { tool: 'build_run', flags: [] },
+  'build-run': {
+    tool: 'build_run',
+    flags: [
+      { flag: '--id', key: 'id', type: 'integer' },
+      { flag: '--branch', key: 'branch', type: 'string' },
+    ],
+  },
 }
 
 /**

package/packages/agent-hooks/src/rules/impl/adl-pr-complete-pending.ts

@@ -1,9 +1,9 @@
 /**
  * `adl.pr-complete-pending-decision` — docs/operations/agent-permissions.md row 9
- * ("PR complete / set auto-complete"), marked **OPEN** in the matrix: denied
- * for BOTH `agent-tarun`/`agent-vivek` AND `agent-reviewer` "until Tarun
- * decides", as its own separately named rule specifically so it can be
- * relaxed (or given a real role split) without touching
+ * ("PR complete / set auto-complete"), DECIDED: denied for every identity —
+ * `agent-tarun`/`agent-vivek` AND `agent-reviewer` alike — as its own
+ * separately named rule specifically so the denial (or a future role split)
+ * can be relaxed without touching
  * `adl.pr-create-update-role` (row 5), which keeps allowing a plain PR
  * create/update for builders and `agent-reviewer` throughout
  * (docs/specs/two-branch-standard-2026-09-27.md §1b.5: auto-complete is armed
@@ -16,9 +16,9 @@
  * owner decision unrelated to this row, and denying that would block PR
  * creation entirely).
  *
- * Deliberately does NOT require an identity to be present: row 9 is OPEN
- * regardless of who is asking, including a caller with no session identity at
- * all (whichever rule reports first, the outcome is the same: denied).
+ * Deliberately does NOT require an identity to be present: row 9 denies
+ * EVERY identity, including a caller with no session identity at all
+ * (whichever rule reports first, the outcome is the same: denied).
  */
 
 import type { Invocation } from '../shell/invocation.ts'
@@ -36,7 +36,7 @@ export const adlPrCompletePendingDecision: RuleSpec = {
   severity: 'deny',
   enabledByDefault: true,
   summary:
-    'Deny PR completion / auto-complete for every identity — open decision (docs/operations/agent-permissions.md row 9) — the MCP tool AND its adl mcp cli equivalent.',
+    'Deny PR completion / auto-complete for every identity (docs/operations/agent-permissions.md row 9) — the MCP tool AND its adl mcp cli equivalent.',
   params: noParams,
   match(inv: Invocation): Finding | null {
     // `adl mcp cli
@@ -54,7 +54,7 @@ export const adlPrCompletePendingDecision: RuleSpec = {
     return {
       user,
       agent:
-        `DENIED ${user} (docs/operations/agent-permissions.md row 9, marked OPEN). Create or update the PR's title/description ` +
+        `DENIED ${user} (docs/operations/agent-permissions.md row 9: denied for every identity). Create or update the PR's title/description ` +
         `normally; do not pass autoComplete, mergeStrategy, or deleteSourceBranch. Blocked: ${ctx.snippet}`,
     }
   },

package/packages/agent-hooks/src/rules/impl/adl-pr-role.ts

@@ -34,11 +34,12 @@
  * regardless of who is asking, and the two rules never fight over the same
  * call.
  *
- * Rows 6 and 7 (PR comment; PR vote) are the same allow-set shape, but
- * `packages/azdo` has no comment/vote tool today — grepped 2026-09-27,
- * nothing named `pr_review`/`pr_comment`/`pr_vote` exists. PENDING: add a
- * sibling check here (or a new rule) when Stream B ships one, rather than
- * matching a guessed tool name now.
+ * Rows 6-8 (PR comment; PR vote on `main`; PR vote on `integration`) ship
+ * their own gate now: the sibling `adl-pr-review-role.ts` rules
+ * `pr_review` (shipped in `packages/azdo/src/azdo-pr-review.ts`, C3
+ * 2026-09-27) — comment allowed for the same allow-set as row 5, vote
+ * allowed for `agent-reviewer` only and only on `main`. This rule does not
+ * match `pr_review` at all; the two rules never fight over the same call.
  *
  * Requires an identity to already be present (`ADL_AGENT_ID_AGENT`
  * non-blank) — with no identity at all, `adl.run-required-for-writes`

package/packages/agent-hooks/src/rules/impl/agent-tamper-protection.ts

@@ -2,21 +2,22 @@
  * Editing the files that wire the host's hooks.
  *
  * Handoff 5, rule 5: deny Write/Edit/MultiEdit/NotebookEdit on
- * `.claude/settings.json`, `.claude/settings.local.json`, or
- * `.codex/config.toml`. These are the files that install the hook into the
- * host (including the `.local.json` overrides). Editing any of them is a way
- * to switch the gate off without anyone noticing.
+ * `.claude/settings.json`, `.claude/settings.local.json`,
+ * `.codex/config.toml`, or `adl-config.toml`. These are the files that
+ * install the hook into the host (including the `.local.json` overrides)
+ * or that the running hook reads on every call — editing any of them is a
+ * way to switch the gate off without anyone noticing.
  *
- * `adl-config.toml` was the fourth file until 2026-10-01 (Tarun: "nobody
- * should stop editing adl-config.toml"). It is no longer on the list, so an
- * agent can edit, move or delete it. Two things follow, both accepted by the
- * owner: (1) every hook run re-reads it, so `[hooks] enabled = false` (a
- * silent no-op, `main.ts`'s `runHook`) or a `[rules."<id>"] enabled = false`
- * takes effect on the agent's next tool call, ahead of any commit — the
- * commit-time layers (`git.protected-tree-commit`, repo-controls' integrity
- * gate) are the only review left; (2) the carriers that stayed on the list
- * below are only as strong as that file, since it can also switch THIS rule
- * off.
+ * `adl-config.toml` left the list on 2026-10-01 (Tarun: "nobody should
+ * stop editing adl-config.toml") and rejoined it on 2026-10-12, after a
+ * review-of-the-door confirmed the gap: every hook run re-reads it, so
+ * `[hooks] enabled = false` (a silent no-op, `main.ts`'s `runHook`) or a
+ * `[rules."<id>"] enabled = false` takes effect on the agent's next tool
+ * call, ahead of any commit. The commit-time layers
+ * (`git.protected-tree-commit`, repo-controls' integrity gate) fire on the
+ * COMMITTED file, not on the working-tree copy that the running hook
+ * reads. The carriers on the list below are only as strong as that file,
+ * since it can also switch THIS rule off.
  *
  * Hooks are local-repo-first (Tarun, 2026-09-29): there is no managed-hooks
  * lock and no global carrier, so these per-repo carrier files are the ONLY

package/packages/agent-hooks/src/rules/impl/git-core.ts

@@ -49,10 +49,9 @@ export const gitHooksPath: RuleSpec = {
       'git -c core.hooksPath=/dev/null commit -m x',
       'git -c core.hooksPath= push',
       'git -c core.hooksPath=/tmp/empty commit --amend',
-      'git config core.hooksPath /dev/null',
-      'git config --global core.hooksPath /tmp/empty',
     ],
-    allow: ['git stash --help', 'git config user.name t'],
+    // The `git config core.hooksPath …` positive controls were here for years — gone as of Bug 695 (2026-10-12): `adl.git-user-override-block` denies every `git config` invocation in the engine, so a `git config …` string is denied upstream and never exercises the `subcommand === 'config' && overridesHooksPath(git.rest)` branch (the `-c` deny entries above still cover the override surface).
+    allow: ['git stash --help'],
   },
 }
 
@@ -91,11 +90,8 @@ export const gitCoreBare: RuleSpec = {
     deny: [
       'git -c core.bare=true status',
       'git -c core.bare=false commit -m x',
-      'git config core.bare true',
-      'git config --bool core.bare true',
-      'git config --global core.bare true',
-      'git config --unset core.bare',
     ],
-    allow: ['git status', 'git config user.name t'],
+    // The `git config core.bare …` positive controls were here for years — gone as of Bug 695 (2026-10-12): `adl.git-user-override-block` denies every `git config` invocation in the engine, so a `git config …` string is denied upstream and never exercises the `subcommand === 'config' && flipsCoreBare(git.rest)` branch (the `-c` deny entries above still cover the override surface).
+    allow: ['git status'],
   },
 }

package/packages/agent-hooks/src/rules/impl/mcp-tool.ts

@@ -50,7 +50,7 @@ export function toolNameEndingWithKnownSuffix(tool: string, knownSuffixes: Reado
  *
  * Shared by every rule that gates an Azure DevOps MCP tool by name
  * (adl-run-required.ts, adl-pr-role.ts, adl-pr-complete-pending.ts,
- * adl-workitem-role.ts, adl-build-run-denied.ts) so the parsing cannot drift
+ * adl-workitem-role.ts, adl-build-run-role.ts) so the parsing cannot drift
  * between them.
  *
  * Prefix-less fallback (added 2026-09-28 with the one-agent-identity

package/packages/agent-hooks/src/rules/registry.ts

@@ -25,6 +25,7 @@ import type { AnyRuleSpec, RuleId } from './spec.ts'
 import { asAnyRuleSpec, corpusIsEmpty } from './spec.ts'
 
 import { gitHooksPath, gitCoreBare } from './impl/git-core.ts'
+import { adlGitUserOverrideBlock } from './impl/adl-git-user-override-block.ts'
 import { gitStash, gitClean, gitRebase, gitFilterBranch, gitRestore, gitReset, gitUpdateIndex } from './impl/git-transitions.ts'
 import { gitNoVerify, gitAmend } from './impl/git-verify.ts'
 import { gitProtectedTreeCommit } from './impl/git-protected-tree.ts'
@@ -63,7 +64,7 @@ import { adlPrCreateUpdateRole } from './impl/adl-pr-role.ts'
 import { adlPrReviewRole } from './impl/adl-pr-review-role.ts'
 import { adlPrCompletePendingDecision } from './impl/adl-pr-complete-pending.ts'
 import { adlWorkitemRequiresTarunOrVivek } from './impl/adl-workitem-role.ts'
-import { adlBuildRunDenied } from './impl/adl-build-run-denied.ts'
+import { adlBuildRunRole } from './impl/adl-build-run-role.ts'
 import { toolFind } from './impl/tool-find.ts'
 import { toolGrep } from './impl/tool-grep.ts'
 import { toolNativeSearch } from './impl/tool-native-search.ts'
@@ -85,6 +86,14 @@ import { agentTamperProtection } from './impl/agent-tamper-protection.ts'
 export const GIT_RULES: readonly AnyRuleSpec[] = [
   gitHooksPath,
   gitCoreBare,
+  // Right after the `core.*` override rules: a `user.*` override rides
+  // along with any subcommand via `-c user.*=`, exactly the way
+  // `core.hooksPath` / `core.bare` do — a `git -c user.name=human commit`
+  // / `push` should be reported as the user override, not whatever
+  // commit/push policy would otherwise report. The user's call (2026-10-12)
+  // is "no use of git -c user* at all … blanket ban for agents"; see
+  // CONTRIBUTING.md line 18 and INVARIANTS.md line 55.
+  adlGitUserOverrideBlock,
   gitStash,
   gitClean,
   gitRebase,
@@ -150,7 +159,7 @@ export const TOOL_RULES: readonly AnyRuleSpec[] = [
   adlPrReviewRole,
   adlPrCompletePendingDecision,
   adlWorkitemRequiresTarunOrVivek,
-  adlBuildRunDenied,
+  adlBuildRunRole,
 ].map(
   asAnyRuleSpec,
 )

package/packages/agent-hooks/src/rules/shell/protected-carriers.ts

@@ -29,10 +29,14 @@ export const PROTECTED_CARRIER_PATHS: ReadonlySet<string> = new Set([
   '.claude/settings.json',
   '.claude/settings.local.json',
   '.codex/config.toml',
-  // `adl-config.toml` was the fourth entry until 2026-10-01 (Tarun: "nobody
-  // should stop editing adl-config.toml"). It stays human-landed at commit time
-  // (`git.protected-tree-commit`, repo-controls' integrity gate), but an agent
-  // can now write it, and every hook run re-reads it.
+  // `adl-config.toml` is the repo's hook switch — every hook run re-reads it,
+  // so an agent that writes `[hooks] enabled = false` or disables any rule
+  // flips the gate off before the next tool call lands. Re-listed here on
+  // 2026-10-12 (Tarun: "we left a door open, close it"). The earlier
+  // 'human-only at commit time' assumption was wrong: the commit-time gate
+  // fires for the COMMITTED file, not for edits that never stage, and the
+  // working-tree copy is what every running hook reads.
+  'adl-config.toml',
   '.codex/hooks.json',
   '.cursor/hooks.json',
   '.opencode/plugins/adl-repo.ts',