@amsterdamdatalabs/adl-agent-control-linux-x64 0.1.35 → 0.1.46

package/bin/adl

@@ -1,4 +1,4 @@
 [diffend] Oversized file quarantined before diffing.
 name: package/bin/adl
-size: 82949600 bytes
-sha256: 42e867b263b1cb13e200275f93036ccdaca15e3902ed11b60efbdea3730d96a3
+size: 83039712 bytes
+sha256: 4d5b5b238a4691c251c90bba64dbf4e528e869c23c7fac82a1f07ac330b910f6

package/bin/reconcile

@@ -69,8 +69,9 @@ source_mode="npm"
 # can point it at a disposable test_root directory (RECONCILE_SOURCE_ONLY=1)
 # and exercise the real sync/removal mechanics without root or a real
 # /usr/local. The production value is the libexec dir the apps/cli
-# commands (repo-controls, skills, hooks, settings) resolve the projected
-# payload from.
+# commands (repo-controls, hooks, settings) resolve the projected payload
+# from. az697 dropped `skills` from the libexec consumers: every skill
+# now comes from `adl skills deploy`, not from the fleet projection.
 repo_dir_libexec_root="/usr/local/libexec/adl"
 # Test-only escape hatch for default-agent-file.ts / managed-settings.ts's own
 # `--root` (both already accept it; see their headers). Unset in every real
@@ -2844,9 +2845,6 @@ project_adl_package_payload() {
     fi
   done
   if [[ "$mode" != apply ]]; then
-    if [[ "$source_mode" == checkout ]]; then
-      echo "would build agent-skills payload from checkout"
-    fi
     echo "would project Adl package payload from $repo_root to /usr/local/libexec/adl and /usr/local/bin/git{,-ado}"
     if [[ "$source_mode" == npm ]]; then
       echo "would link /usr/local/bin/adl to $repo_root/bin/adl"
@@ -2855,12 +2853,6 @@ project_adl_package_payload() {
   fi
   bun_bin="$(command -v bun || true)"
   [[ -n "$bun_bin" ]] || { echo "ERROR Adl package projection requires bun on PATH" >&2; return 1; }
-  if [[ "$source_mode" == checkout ]]; then
-    (cd "$repo_root/packages/agent-skills" && "$bun_bin" run build) || {
-      echo "ERROR could not build agent-skills payload from checkout" >&2
-      return 1
-    }
-  fi
   local system_root_args=()
   if [[ -n "${RECONCILE_TEST_SYSTEM_ROOT:-}" ]]; then
     system_root_args+=(--system-root "$RECONCILE_TEST_SYSTEM_ROOT")

package/bin/setup

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-# `sudo adl setup --host NAME` -- the whole onboarding of a host after
+# `sudo adl fleet setup NAME` -- the whole onboarding of a host after
 # `bun install -g @amsterdamdatalabs/adl-agent-control` (run as the device's
 # administrator):
 #
@@ -45,15 +45,15 @@ while [[ "$#" -gt 0 ]]; do
     *) echo "ERROR unknown argument: $1" >&2; exit 2 ;;
   esac
 done
-[[ -n "$host" ]] || { echo "ERROR usage: sudo adl setup --host NAME" >&2; exit 2; }
-[[ "$(id -u)" -eq 0 ]] || { echo "ERROR adl setup must run as root: sudo adl setup --host $host" >&2; exit 1; }
+[[ -n "$host" ]] || { echo "ERROR usage: sudo adl fleet setup NAME" >&2; exit 2; }
+[[ "$(id -u)" -eq 0 ]] || { echo "ERROR adl fleet setup must run as root: sudo adl fleet setup $host" >&2; exit 1; }
 
 script_dir="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
 package_dir="$(cd -- "$script_dir/.." && pwd)"
 package_dir_real="$(cd -P -- "$script_dir/.." && pwd -P)"
 # shellcheck source=lib/fleet-host.sh
 source "$script_dir/lib/fleet-host.sh"
-fleet_host_resolve "adl setup" "$package_dir/packages/fleet/manifest.json" "$host" || exit $?
+fleet_host_resolve "adl fleet setup" "$package_dir/packages/fleet/manifest.json" "$host" || exit $?
 owner="$fleet_host_owner"
 minute="$fleet_host_minute"
 
@@ -66,23 +66,23 @@ minute="$fleet_host_minute"
 source "$script_dir/lib/adl-package.sh"
 os_name="$(uname -s)"
 owner_home="$(adl_owner_home "$owner")" || {
-  echo "ERROR adl setup: cannot resolve the home directory of $owner" >&2
+  echo "ERROR adl fleet setup: cannot resolve the home directory of $owner" >&2
   exit 1
 }
 managed_dir="$(adl_platform_package_dir "$(adl_global_node_modules "$owner_home")" "$os_name" "$(uname -m)")" || exit 1
 managed_real="$(cd -P -- "$managed_dir" 2>/dev/null && pwd -P)" || managed_real=""
 if [[ -z "$managed_real" || "$package_dir_real" != "$managed_real" ]]; then
   {
-    echo "ERROR adl setup: this package ($package_dir_real) is not the package the scheduled job manages ($managed_dir)."
-    echo "ERROR adl setup: install it where the job looks, as $owner, then run setup again:"
-    echo "ERROR adl setup:   bun install -g @amsterdamdatalabs/adl-agent-control"
+    echo "ERROR adl fleet setup: this package ($package_dir_real) is not the package the scheduled job manages ($managed_dir)."
+    echo "ERROR adl fleet setup: install it where the job looks, as $owner, then run setup again:"
+    echo "ERROR adl fleet setup:   bun install -g @amsterdamdatalabs/adl-agent-control"
   } >&2
   exit 1
 fi
 
 adl_bin="$package_dir_real/bin/adl"
-[[ -x "$adl_bin" ]] || { echo "ERROR adl setup: the package adl is missing or not executable: $package_dir/bin/adl" >&2; exit 1; }
-adl_check_adl_not_shadowed "$owner" "$os_name" "$owner_home" "$package_dir_real" "adl setup" || exit 1
+[[ -x "$adl_bin" ]] || { echo "ERROR adl fleet setup: the package adl is missing or not executable: $package_dir/bin/adl" >&2; exit 1; }
+adl_check_adl_not_shadowed "$owner" "$os_name" "$owner_home" "$package_dir_real" "adl fleet setup" || exit 1
 
 if [[ -n "${ADL_SETUP_TEST_ROOT:-}" ]]; then
   system_root="${ADL_SETUP_TEST_ROOT%/}"
@@ -121,11 +121,11 @@ fi
 
 mkdir -p "$system_root/var/lib/adl" "$system_root/var/log/adl"
 
-echo "adl setup: first reconcile for $host (owner $owner)"
+echo "adl fleet setup: first reconcile for $host (owner $owner)"
 reconcile_rc=0
 "$adl_bin" reconcile --host "$host" || reconcile_rc=$?
 if [[ "$reconcile_rc" -ne 0 ]]; then
-  echo "ERROR adl setup: first reconcile failed (exit $reconcile_rc); scheduler NOT armed. Fix the failure and re-run: sudo adl setup --host $host" >&2
+  echo "ERROR adl fleet setup: first reconcile failed (exit $reconcile_rc); scheduler NOT armed. Fix the failure and re-run: sudo adl fleet setup $host" >&2
   exit "$reconcile_rc"
 fi
 
@@ -166,7 +166,7 @@ case "$fleet_host_platform" in
         sleep 0.5
       done
       [[ "$unloaded" -eq 1 ]] || {
-        echo "ERROR adl setup: com.adl.global-tools is still loaded after bootout (waited 5s); not bootstrapping. Run: sudo launchctl bootout system/com.adl.global-tools" >&2
+        echo "ERROR adl fleet setup: com.adl.global-tools is still loaded after bootout (waited 5s); not bootstrapping. Run: sudo launchctl bootout system/com.adl.global-tools" >&2
         exit 1
       }
     fi
@@ -214,7 +214,7 @@ esac
 # would keep running stale update logic if anyone invoked it.
 if [[ -e "$legacy_adl_sync" ]]; then
   rm -f -- "$legacy_adl_sync"
-  echo "adl setup: removed the legacy scheduler copy $legacy_adl_sync"
+  echo "adl fleet setup: removed the legacy scheduler copy $legacy_adl_sync"
 fi
 
-echo "adl setup: $host reconciled and armed (every 12 hours at minute $minute); run on demand with: sudo adl reconcile --host $host"
+echo "adl fleet setup: $host reconciled and armed (every 12 hours at minute $minute); run on demand with: sudo adl reconcile --host $host"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amsterdamdatalabs/adl-agent-control-linux-x64",
-  "version": "0.1.35",
+  "version": "0.1.46",
   "description": "adl CLI binary for linux/x64 (agent identity + Azure DevOps front door — see docs/architecture/cli-design.md)",
   "license": "UNLICENSED",
   "os": [

package/packages/agent-hooks/deploy-profile.json

@@ -40,7 +40,7 @@
       "file": ".opencode/plugins/adl-repo.ts",
       "hostSuffix": "opencode",
       "matchers": {
-        "Bash": "bash",
+        "Bash": "bash|shell",
         "Write|Edit|MultiEdit|StrReplace|str_replace_editor|edit_file|str_replace|replace_in_file|create_file|write_file": "write|edit"
       },
       "unmappedMatcher": "keep",

package/packages/agent-hooks/package.json

@@ -8,7 +8,7 @@
     "start": "bun src/main.ts",
     "build": "bun ../../workflows/scripts/build/agent-hooks/build.ts",
     "typecheck": "tsc --noEmit",
-    "test": "bun test --coverage --timeout 30000",
+    "test": "bun test --isolate --coverage --timeout 30000",
     "check": "bun run typecheck && bun test --coverage"
   },
   "dependencies": {

package/packages/agent-hooks/src/main.ts

@@ -26,6 +26,11 @@
  *     silent no-op (exit 0, empty stdout/stderr).
  *   - `adl-config.toml` present but fails to parse/decode: fail
  *     loud (non-zero exit, reason on stderr) — never silently ignored.
+ *     `pre-tool-use` exits at FAIL_CLOSED_EXIT_CODE (2); every other
+ *     kind exits at the non-blocking NON_BLOCKING_FAIL_EXIT_CODE (1),
+ *     matching the host-resolution and invalid-JSON-on-stdin branches
+ *     above and avoiding the Claude Code/Codex `UserPromptSubmit`
+ *     erase-on-exit-2 behaviour (this file's header, work item D).
  *   - `[hooks] enabled = false`: silent no-op, same as unmanaged.
  *
  * Every other hook kind is dispatched through the shared `HookHandler` shape
@@ -202,13 +207,29 @@ export async function run(argv: readonly string[], adlVersion?: string): Promise
 
   let config: AdlRepoConfig
   {
-    const text = readFileSync(managed.configPath, 'utf8')
+    let text: string
+    try {
+      text = readFileSync(managed.configPath, 'utf8')
+    } catch (error) {
+      // The readFileSync race: `resolveManagedRepo` confirmed the marker
+      // exists a moment ago, but the file was unlinked, perm-removed, or
+      // became unreadable before we opened it. Same kind-conditional
+      // exit-code split as the JSON-stdin branch above and az385's
+      // host-resolution branch: pre-tool-use fails CLOSED (refuse the
+      // dangerous action), every other kind fails at the non-blocking
+      // exit 1 so a Claude Code `UserPromptSubmit` or an advisory
+      // `briefing` is never erased.
+      process.stderr.write(
+        `adl hook: cannot read ${managed.configPath}: ${String(error)}\n`,
+      )
+      return kind === 'pre-tool-use' ? FAIL_CLOSED_EXIT_CODE : NON_BLOCKING_FAIL_EXIT_CODE
+    }
     const decoded = decodeConfig(text)
     if (!decoded.ok) {
       process.stderr.write(
         `adl hook: ${describeConfigIssue(managed.configPath, decoded.issue)}\n`,
       )
-      return 1
+      return kind === 'pre-tool-use' ? FAIL_CLOSED_EXIT_CODE : NON_BLOCKING_FAIL_EXIT_CODE
     }
     config = decoded.value
   }

package/packages/agent-hooks/src/pre-tool-use/handler.ts

@@ -284,7 +284,7 @@ const IDENTITY_RULE_IDS: ReadonlySet<RuleId> = new Set([
  * The four role-gate rules that deny a SPECIFIC Azure DevOps MCP tool call by
  * the caller's identity (`adl.workitem-requires-tarun-or-vivek`,
  * `adl.pr-create-update-role`, `adl.pr-review-role`,
- * `adl.build-run-denied`). None of these are in `IDENTITY_RULE_IDS` above —
+ * `adl.build-run-role`). None of these are in `IDENTITY_RULE_IDS` above —
  * that set covers the rules that fire when no identity is resolved or
  * carried, never a rule that denies WITH an identity already resolved, on the
  * strength of who that identity is. Each of them can only fire on the same
@@ -297,7 +297,7 @@ const ROLE_GATE_RULE_IDS: ReadonlySet<RuleId> = new Set([
   'adl.workitem-requires-tarun-or-vivek',
   'adl.pr-create-update-role',
   'adl.pr-review-role',
-  'adl.build-run-denied',
+  'adl.build-run-role',
 ])
 
 type IdentitySourceLabel = 'inline' | 'env' | 'default-file' | 'none'

package/packages/agent-hooks/src/rules/impl/adl-build-run-role.ts

@@ -0,0 +1,116 @@
+/** `adl.build-run-role` — docs/operations/agent-permissions.md row 12 (build run), decision H1; the allow condition and the caller-declared id-is-its-own-PR-validation-build approximation (hook has no network; azdo core must re-verify) are documented on match() below and in the summary. */
+
+import type { Invocation } from '../shell/invocation.ts'
+import type { Finding, MessageContext, RuleContext, RuleSpec } from '../spec.ts'
+import { noParams } from '../spec.ts'
+import { BRANCH_PREFIXES } from '../../../../azdo/src/lib/commit-types.ts'
+import { BUILDER_AGENTS, resolveFromEnvOrFile } from './adl-identity.ts'
+import { detailString } from './messages.ts'
+import { mcpToolName } from './mcp-tool.ts'
+import { effectiveIdentityForMcpCli, toolCallFor } from './adl-mcp-cli.ts'
+
+const RULE_ID = 'adl.build-run-role'
+
+const PROTECTED_BRANCHES: ReadonlySet<string> = new Set(['integration', 'main'])
+const FEATURE_PREFIXES: readonly string[] = BRANCH_PREFIXES.map((prefix) => `${prefix}/`)
+
+type Violation = 'not-a-builder' | 'missing-id' | 'missing-branch' | 'non-feature-branch'
+
+function normalizeBranchRef(ref: string): string {
+  return ref.startsWith('refs/heads/') ? ref.slice('refs/heads/'.length) : ref
+}
+
+function isFeatureBranchName(branch: string): boolean {
+  return FEATURE_PREFIXES.some((prefix) => branch.startsWith(prefix))
+}
+
+export const adlBuildRunRole: RuleSpec = {
+  id: RULE_ID,
+  category: 'tool-call',
+  severity: 'deny',
+  enabledByDefault: true,
+  summary:
+    'Deny build_run except the lead (agent-tarun/agent-vivek) re-queuing its own PR’s validation pipeline on that PR’s feature branch (docs/operations/agent-permissions.md row 12, H1) — the MCP tool AND its adl mcp cli equivalent.',
+  params: noParams,
+  match(inv: Invocation, ctx: RuleContext<Record<string, never>>): Finding | null {
+    // Also catch `adl mcp cli build-run` — same tool, same grade.
+    const call = toolCallFor(inv)
+    if (call === null) return null
+    if (mcpToolName(call.tool) !== 'build_run') return null
+
+    // Grade the EFFECTIVE identity for THIS call — an inline ADL_AGENT_ID_AGENT= override on the same CLI invocation wins, like the other role rules.
+    const resolution = resolveFromEnvOrFile(ctx.env)
+    const fallback = resolution.ok ? resolution.agent : null
+    const agent = effectiveIdentityForMcpCli(inv, ctx.command ?? '', fallback)
+    if (agent === null) return null // no identity at all: adl.run-required-for-writes's job
+
+    // 1. Only the lead re-queues CI — the role mismatch reports first regardless of shape.
+    if (!BUILDER_AGENTS.has(agent)) {
+      return { ruleId: RULE_ID, severity: 'deny', detail: { tool: call.tool, violation: 'not-a-builder' satisfies Violation } }
+    }
+
+    // 2. The definition id, validated exactly like azdo-pl.ts's buildRun (a positive integer).
+    const id = call.input.id
+    if (typeof id !== 'number' || !Number.isInteger(id) || id < 1) {
+      return { ruleId: RULE_ID, severity: 'deny', detail: { tool: call.tool, violation: 'missing-id' satisfies Violation } }
+    }
+
+    // 3. The PR source branch, caller-declared exactly like pr_review's targetBranch: required, and provably a feature branch.
+    const branch = call.input.branch
+    if (typeof branch !== 'string' || branch.trim().length === 0) {
+      return { ruleId: RULE_ID, severity: 'deny', detail: { tool: call.tool, violation: 'missing-branch' satisfies Violation } }
+    }
+    const normalized = normalizeBranchRef(branch.trim())
+    if (PROTECTED_BRANCHES.has(normalized) || !isFeatureBranchName(normalized)) {
+      return { ruleId: RULE_ID, severity: 'deny', detail: { tool: call.tool, violation: 'non-feature-branch' satisfies Violation } }
+    }
+
+    return null
+  },
+  message(finding: Finding, ctx: MessageContext) {
+    const tool = detailString(finding, 'tool')
+    const violation = detailString(finding, 'violation') as Violation
+
+    if (violation === 'not-a-builder') {
+      const user = 'this operation can only be done with agent-tarun or agent-vivek'
+      return {
+        user,
+        agent:
+          `DENIED ${tool}: ${user}. Only the lead may re-queue its own PR’s validation pipeline on that PR’s ` +
+          `source branch — agent-reviewer runs no implementation PRs, so it has no PR CI to re-queue. Blocked: ${ctx.snippet}`,
+      }
+    }
+
+    if (violation === 'missing-id') {
+      const user = 'a build definition id is required'
+      return {
+        user,
+        agent: `DENIED ${tool}: ${user} — pass the definition id of your PR’s validation pipeline (a positive integer). Blocked: ${ctx.snippet}`,
+      }
+    }
+
+    if (violation === 'missing-branch') {
+      const user = 'name the source branch of your own PR to re-queue its validation pipeline'
+      return {
+        user,
+        agent:
+          `DENIED ${tool}: ${user}. The branch argument is what lets this hook scope the re-queue to your own ` +
+          `PR’s CI — without it, pipelines run on their own triggers. Re-queue with \`branch\` naming your PR’s ` +
+          `feature branch. Blocked: ${ctx.snippet}`,
+      }
+    }
+
+    const user = 'only a feature branch that is your own PR’s source branch may be re-queued'
+    return {
+      user,
+      agent:
+        `DENIED ${tool}: ${user}. \`integration\`/\`main\` and every unrecognized branch name are denied — a PR’s ` +
+        `source branch always carries a \`${FEATURE_PREFIXES.join(' ')}\` prefix. Blocked: ${ctx.snippet}`,
+    }
+  },
+  corpus: {
+    // Tool-call rule; real coverage is tests/unit/rules-adl-build-run-role.test.ts (the shared shell corpus only proves non-firing on unrelated commands).
+    deny: [],
+    allow: ['ls -la', 'git status'],
+  },
+}

package/packages/agent-hooks/src/rules/impl/adl-git-user-override-block.ts

@@ -0,0 +1,159 @@
+/** `adl.git-user-override-block` — blanket deny (2026-10-12) of every `user.name` / `user.email` / `user.useConfigOnly` override on a git command: inline `-c user.*=…` / `--config-env user.*=…` (separated, bundled, or bare next-token), the `GIT_CONFIG_COUNT` / `GIT_CONFIG_KEY_<n>` / `GIT_CONFIG_VALUE_<n>` env-var equivalent, AND any `git config` invocation at all (read or write — the whole subcommand is closed; an agent that needs the current identity runs `git var GIT_AUTHOR_IDENT` or reads `.git/config` directly). The only allowed identity path is `ADL_AGENT_ID_AGENT=agent-tarun` on the command line so the front controller (`bin/git-ado`) stamps the right committer. Placed 3rd in `GIT_RULES`, right after the two `core.*` override rules, so a `user.*` ride-along on any subcommand reports as the user override, not the subcommand rule. The pre-commit hook (the `prepare-commit-msg` / `commit-msg` pair `bin/git-ado` calls) used to catch the *result* on `git commit`, but not on `git commit-tree` / `git fast-import` / etc. — this rule closes the gap at the command level, before git ever sees the override. */
+
+import { isHelpOnlyInvocation } from './git-helpers.ts'
+import type { Finding, MessageContext, RuleContext, RuleSpec } from '../spec.ts'
+import { noParams } from '../spec.ts'
+import { gitAgentTail } from './messages.ts'
+import type { Invocation } from '../shell/invocation.ts'
+import { tokenValue } from '../shell/token.ts'
+
+/** `user.name`, `user.email`, `user.useConfigOnly` — case-insensitive. */
+const USER_KEY = /^user\.(name|email|useconfigonly)\b/i
+
+/** `GIT_CONFIG_COUNT=<n>` where `<n>` is a non-zero integer — captured so the env-var form's scope gate (the COUNT must be non-zero for git to read any of the KEY/VALUE pairs) is enforced, not assumed. */
+const GIT_CONFIG_COUNT_RE = /\bGIT_CONFIG_COUNT\s*=\s*([1-9]\d*)\b/i
+/** `GIT_CONFIG_KEY_<n>=<value>` — `<value>` is checked against `USER_KEY` separately. */
+const GIT_CONFIG_KEY_RE = /\bGIT_CONFIG_KEY_\d+\s*=\s*([^\s'"`;&|<>(){}]+)/gi
+
+function gitInvocation(inv: Invocation): Invocation & { kind: 'git' } | null {
+  return inv.kind === 'git' ? inv : null
+}
+
+/** True when `tokens` (the post-`-c` value tokens) contains a `user.*` key; strips a single leading `-c` so the bundled `-cuser.name=Foo` form (whole-token consumed by `scanGitGlobals`) matches the same regex as the separated form. */
+function tokensOverrideUser(tokens: readonly { readonly value: string }[]): boolean {
+  for (const token of tokens) {
+    const raw = tokenValue(token as Parameters<typeof tokenValue>[0])
+    // Bundled `-cuser.name=Foo`: drop the leading `-c` so the regex below matches.
+    const value = raw.startsWith('-c') && raw.length > 2 ? raw.slice(2) : raw
+    if (USER_KEY.test(value)) return true
+  }
+  return false
+}
+
+/** True when `command` carries the `GIT_CONFIG_*` env-var form of a `user.*` override: a non-zero `GIT_CONFIG_COUNT=<n>` AND at least one `GIT_CONFIG_KEY_<n>=user.<…>` (both must be present; a lone KEY without a non-zero COUNT is a no-op and not a bypass). */
+function envVarOverrideUser(command: string): boolean {
+  if (!GIT_CONFIG_COUNT_RE.test(command)) return false
+  // Reset the shared `g`-flag regex's lastIndex between calls (stateful).
+  GIT_CONFIG_KEY_RE.lastIndex = 0
+  for (;;) {
+    const match = GIT_CONFIG_KEY_RE.exec(command)
+    if (match === null) return false
+    if (USER_KEY.test(match[1] as string)) return true
+  }
+}
+
+export const adlGitUserOverrideBlock: RuleSpec = {
+  id: 'adl.git-user-override-block',
+  category: 'git',
+  severity: 'deny',
+  enabledByDefault: true,
+  summary: 'Blanket deny (2026-10-12) of every `user.*` override on a git command: inline `-c` / `--config-env`, the `GIT_CONFIG_*` env-var equivalent, AND any `git config` invocation at all (read or write — the whole subcommand is closed; `git var GIT_AUTHOR_IDENT` is the only way an agent reads the current identity). The only allowed identity path is `ADL_AGENT_ID_AGENT=agent-tarun` on the command line.',
+  params: noParams,
+  match(inv, ctx: RuleContext<Record<string, never>>): Finding | null {
+    const git = gitInvocation(inv)
+    if (!git) return null
+    if (isHelpOnlyInvocation(git.rest)) return null
+    // Blanket inline-override surface: `-c user.*=…` / `--config-env user.*=…` (and the bare-token / bundled forms) land in `git.globals`.
+    if (tokensOverrideUser(git.globals)) {
+      return { ruleId: 'adl.git-user-override-block', severity: 'deny', detail: {} }
+    }
+    // Env-var form: `GIT_CONFIG_*` assignments are consumed by `walk()` before the `git` Invocation is built; scan the raw `ctx.command`.
+    if (ctx.command !== undefined && envVarOverrideUser(ctx.command)) {
+      return { ruleId: 'adl.git-user-override-block', severity: 'deny', detail: {} }
+    }
+    // Per the 2026-10-12 widening: `git config` is BANNED for agents — every invocation, read or write. An agent that needs to know the current `user.name` runs `git var GIT_AUTHOR_IDENT` or reads `.git/config` directly; `git config` of any kind is the surface that touches persisted config and is closed.
+    if (git.subcommand === 'config') {
+      return { ruleId: 'adl.git-user-override-block', severity: 'deny', detail: {} }
+    }
+    return null
+  },
+  message(_finding: Finding, ctx: MessageContext) {
+    return {
+      user:
+        'Blocked a user.name / user.email / user.useConfigOnly override on a git command. ' +
+        'Inline `-c user.*=…`, `--config-env user.*=`, `GIT_CONFIG_KEY_<n>=user.*` env-var overrides, AND any `git config` invocation are all banned in an agent session.',
+      agent:
+        'DENIED user-identity override on a git command. `git -c user.name=…` / `-c user.email=…` / ' +
+        '`--config-env user.*=…` (in every form — separated, bundled as `-cuser.*=…`, or bare ' +
+        '`-c user.* …`); the `GIT_CONFIG_COUNT=<n> GIT_CONFIG_KEY_<n>=user.* GIT_CONFIG_VALUE_<n>=…` ' +
+        'env-var form (per `git-config(1)`); AND `git config …` of any kind (read or write — the whole ' +
+        'subcommand is closed in an agent session) are blanket-denied in an agent session (2026-10-12). ' +
+        'The only allowed identity path is `ADL_AGENT_ID_AGENT=agent-tarun` on the command line: ' +
+        '`ADL_AGENT_ID_AGENT=agent-tarun git commit -m …` so the front controller (`bin/git-ado`) ' +
+        'stamps the right committer. To read the current identity, run `git var GIT_AUTHOR_IDENT` or ' +
+        'read `.git/config` directly — `git config` is NEVER the right answer in an agent session, ' +
+        `even as a one-shot. ${gitAgentTail(ctx.snippet)}`,
+    }
+  },
+  corpus: {
+    deny: [
+      // `-c user.*=` (separate token)
+      'git -c user.name=Foo commit -m x',
+      'git -c user.email=foo@bar commit -m x',
+      'git -c user.useConfigOnly=true commit -m x',
+      // `-c` bundled with `=` (no space) — the same form `scanGitGlobals` folds
+      'git -cuser.name=Foo commit -m x',
+      'git -cuser.email=foo@bar commit -m x',
+      // bare `-c` + separate-token value (next-token form)
+      'git -c user.name Foo commit -m x',
+      'git -c user.email foo@bar commit -m x',
+      // Case-insensitive
+      'git -c User.Name=Foo commit -m x',
+      'git -c USER.EMAIL=foo@bar commit -m x',
+      // `--config-env` (the env-var form, not just `-c`)
+      'git --config-env user.name=Foo commit -m x',
+      // `user.*` ride-along with a non-commit subcommand — still blocked (blanket)
+      'git -c user.name=Foo push',
+      'git -c user.name=Foo push origin main',
+      'git -c user.email=foo@bar fetch',
+      'git -c user.name=Foo log --oneline',
+      'git -c user.email=foo@bar status',
+      // The GIT_CONFIG_* env-var form — git's own alternative to `-c`; COUNT must be non-zero AND a KEY_<n>=user.* must be present for the bypass to take effect (the rule denies on that pair).
+      'GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=user.name GIT_CONFIG_VALUE_0=Foo git commit -m x',
+      'GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=user.email GIT_CONFIG_VALUE_0=foo@bar git commit -m x',
+      'GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=user.useConfigOnly GIT_CONFIG_VALUE_0=true git commit -m x',
+      // Same, riding along with a non-commit subcommand
+      'GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=user.name GIT_CONFIG_VALUE_0=Foo git push',
+      'GIT_CONFIG_COUNT=2 GIT_CONFIG_KEY_0=user.name GIT_CONFIG_VALUE_0=Foo GIT_CONFIG_KEY_1=user.email GIT_CONFIG_VALUE_1=foo@bar git commit -m x',
+      // Persistent form: `git config user.* …` (including `--global` / `--local` / `--unset` / `--remove-section user`).
+      'git config user.name "agent-tarun"',
+      'git config --global user.name "agent-tarun"',
+      'git config --local user.email "agent-tarun@<org-domain>"',
+      'git config user.useConfigOnly true',
+      'git config --unset user.name',
+      'git config --remove-section user',
+      'git config --remove-section-all user',
+      // Per the 2026-10-12 widening: every `git config` invocation is denied (read or write — the whole subcommand is closed; an agent that needs the current identity runs `git var GIT_AUTHOR_IDENT` or reads `.git/config` directly).
+      'git config --list',
+      'git config --list --local',
+      'git config --get user.name',
+      'git config --get-all user.email',
+      'git config --get-regexp "^user\\."',
+      'git config http.proxy http://proxy:8080',
+      'git config --global core.editor vim',
+      'git config --local init.defaultBranch main',
+    ],
+    allow: [
+      // ordinary git traffic, no user.* anywhere
+      'git status',
+      'git log --oneline',
+      'git commit -m "ordinary commit"',
+      // help invocations are exempted (the only thing in `rest` is a flag)
+      'git -c user.name=Foo --help',
+      // other `-c` keys ride along freely (inline-override surface is the rule, not all `-c` flags)
+      'git -c http.proxy=http://proxy:8080 clone https://github.com/foo/bar',
+      'git -c core.autocrlf=false commit -m x',
+      'git -c init.defaultBranch=main init',
+      // The legitimate identity path: prefix every commit with `ADL_AGENT_ID_AGENT=agent-tarun` so the front controller stamps the right committer. This is what the rule tells the agent to do.
+      'ADL_AGENT_ID_AGENT=agent-tarun git commit -m "an agent commit"',
+      // The legitimate identity read: `git var GIT_AUTHOR_IDENT` (NOT `git config --get user.name`).
+      'git var GIT_AUTHOR_IDENT',
+      // `GIT_CONFIG_*` with no `user.*` key — not a user-override. Agents may legitimately override `http.proxy` or `init.defaultBranch` via the env-var form.
+      'GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=http.proxy GIT_CONFIG_VALUE_0=http://proxy:8080 git clone https://github.com/foo/bar',
+      'GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=init.defaultBranch GIT_CONFIG_VALUE_0=main git init',
+      // `GIT_CONFIG_KEY_<n>=user.*` with no COUNT or COUNT=0 — git ignores the key without a non-zero count, so this is a no-op and not a bypass.
+      'GIT_CONFIG_KEY_0=user.name GIT_CONFIG_VALUE_0=Foo git commit -m x',
+      'GIT_CONFIG_COUNT=0 GIT_CONFIG_KEY_0=user.name GIT_CONFIG_VALUE_0=Foo git commit -m x',
+    ],
+  },
+}

package/packages/agent-hooks/src/rules/impl/adl-mcp-cli.ts

@@ -10,13 +10,14 @@
  * `adl mcp cli pr-review --vote reject ...` reaches Azure DevOps exactly the
  * way `mcp__azdo__pr_review` does, and must be denied the same way.
  *
- * Scoped to the four commands this package's role rules actually gate —
- * `workitem-create-or-update`, `pr-create-or-update`, `pr-review`,
+ * Scoped to the commands this package's role rules actually gate —
+ * `workitem-create-or-update-feature`/`-pbi`/`-bug` (one command per MCP
+ * tool), `pr-create-or-update`, `pr-review`,
  * `build-run` — not a general reimplementation of the whole CLI surface
  * (`packages/azdo/src/cli.ts`'s `commands` table), which belongs to
  * `packages/azdo`, outside this package's write scope. The flag → input-key
  * mapping below is copied from that table (re-checked 2026-09-28) for
- * exactly these four entries; if `cli.ts`'s flags for one of them change,
+ * exactly these entries; if `cli.ts`'s flags for one of them change,
  * this table needs a matching update — there is no cross-package import that
  * would keep the two in sync automatically without also pulling in
  * `tool-dispatch.ts` and everything it depends on.
@@ -56,15 +57,18 @@ interface GatedCommand {
 /**
  * Only the flags a role rule actually inspects: `pr-create-or-update`'s
  * `--action`/`--auto-complete`/`--no-auto-complete`/`--merge-strategy`/
- * `--delete-source-branch` (`isPrCompletionCall`, pr-completion.ts) and
+ * `--delete-source-branch` (`isPrCompletionCall`, pr-completion.ts),
  * `pr-review`'s `--comment`/`--vote`/`--target-branch`
- * (`adl-pr-review-role.ts`). `workitem-create-or-update` and `build-run` are
- * graded on identity alone — no input field changes their outcome — so
- * their flag lists are empty; the command still needs an entry here so it is
- * RECOGNIZED at all.
+ * (`adl-pr-review-role.ts`), and `build-run`'s `--id`/`--branch`
+ * (`adl.build-run-role`). The three `workitem-create-or-update-*` commands
+ * are graded on identity
+ * alone — no input field changes its outcome — so their flag lists are empty;
+ * every command still needs an entry here so it is RECOGNIZED at all.
  */
 const GATED_COMMANDS: Readonly<Record<string, GatedCommand>> = {
-  'workitem-create-or-update': { tool: 'workitem_create_or_update', flags: [] },
+  'workitem-create-or-update-feature': { tool: 'workitem_create_or_update_feature', flags: [] },
+  'workitem-create-or-update-pbi': { tool: 'workitem_create_or_update_pbi', flags: [] },
+  'workitem-create-or-update-bug': { tool: 'workitem_create_or_update_bug', flags: [] },
   'pr-create-or-update': {
     tool: 'pr_create_or_update',
     flags: [
@@ -83,14 +87,20 @@ const GATED_COMMANDS: Readonly<Record<string, GatedCommand>> = {
       { flag: '--target-branch', key: 'targetBranch', type: 'string' },
     ],
   },
-  'build-run': { tool: 'build_run', flags: [] },
+  'build-run': {
+    tool: 'build_run',
+    flags: [
+      { flag: '--id', key: 'id', type: 'integer' },
+      { flag: '--branch', key: 'branch', type: 'string' },
+    ],
+  },
 }
 
 /**
  * `adl`/`adl.exe mcp cli <command> [--flag value|--boolean-flag ...]` → the
  * MCP tool call it is equivalent to, or `null` when `inv` is not this shape,
  * any of the first three words is dynamic, or `<command>` is not one of the
- * four gated commands. A `--flag`'s value is read only when the flag is
+ * six gated commands. A `--flag`'s value is read only when the flag is
  * known for that specific command (an unrecognized flag is ignored, not an
  * error — this is a read for GRADING, not the CLI's own arg parser, which
  * would reject an unknown flag itself before any tool call happens) and the
@@ -156,7 +166,7 @@ export function toolCallFor(inv: Invocation): AdlMcpCliCall | null {
  * `ADL_AGENT_ID_AGENT=` override on the very piece being graded wins. Grading
  * the session identity alone would be wrong in both directions: a reviewer
  * session's own inline `agent-tarun` override on
- * `adl mcp cli workitem-create-or-update` would be denied as `agent-reviewer`
+ * `adl mcp cli workitem-create-or-update-bug` would be denied as `agent-reviewer`
  * (a false deny), and — the more dangerous direction — an `agent-tarun`
  * SESSION with an inline `ADL_AGENT_ID_AGENT=agent-reviewer` override would be
  * graded as `agent-tarun` (a false ALLOW: the piece that will actually run is

package/packages/agent-hooks/src/rules/impl/adl-pr-complete-pending.ts

@@ -1,9 +1,9 @@
 /**
  * `adl.pr-complete-pending-decision` — docs/operations/agent-permissions.md row 9
- * ("PR complete / set auto-complete"), marked **OPEN** in the matrix: denied
- * for BOTH `agent-tarun`/`agent-vivek` AND `agent-reviewer` "until Tarun
- * decides", as its own separately named rule specifically so it can be
- * relaxed (or given a real role split) without touching
+ * ("PR complete / set auto-complete"), DECIDED: denied for every identity —
+ * `agent-tarun`/`agent-vivek` AND `agent-reviewer` alike — as its own
+ * separately named rule specifically so the denial (or a future role split)
+ * can be relaxed without touching
  * `adl.pr-create-update-role` (row 5), which keeps allowing a plain PR
  * create/update for builders and `agent-reviewer` throughout
  * (docs/specs/two-branch-standard-2026-09-27.md §1b.5: auto-complete is armed
@@ -16,9 +16,9 @@
  * owner decision unrelated to this row, and denying that would block PR
  * creation entirely).
  *
- * Deliberately does NOT require an identity to be present: row 9 is OPEN
- * regardless of who is asking, including a caller with no session identity at
- * all (whichever rule reports first, the outcome is the same: denied).
+ * Deliberately does NOT require an identity to be present: row 9 denies
+ * EVERY identity, including a caller with no session identity at all
+ * (whichever rule reports first, the outcome is the same: denied).
  */
 
 import type { Invocation } from '../shell/invocation.ts'
@@ -36,7 +36,7 @@ export const adlPrCompletePendingDecision: RuleSpec = {
   severity: 'deny',
   enabledByDefault: true,
   summary:
-    'Deny PR completion / auto-complete for every identity — open decision (docs/operations/agent-permissions.md row 9) — the MCP tool AND its adl mcp cli equivalent.',
+    'Deny PR completion / auto-complete for every identity (docs/operations/agent-permissions.md row 9) — the MCP tool AND its adl mcp cli equivalent.',
   params: noParams,
   match(inv: Invocation): Finding | null {
     // `adl mcp cli
@@ -54,7 +54,7 @@ export const adlPrCompletePendingDecision: RuleSpec = {
     return {
       user,
       agent:
-        `DENIED ${user} (docs/operations/agent-permissions.md row 9, marked OPEN). Create or update the PR's title/description ` +
+        `DENIED ${user} (docs/operations/agent-permissions.md row 9: denied for every identity). Create or update the PR's title/description ` +
         `normally; do not pass autoComplete, mergeStrategy, or deleteSourceBranch. Blocked: ${ctx.snippet}`,
     }
   },