@bongos/core 1.19.846 → 1.19.847

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.846",
-  "core_contract": "1.19.846",
-  "source_commit": "7875bef1fd719fda2b08d1c47132af0bf09470c0",
+  "core_version": "1.19.847",
+  "core_contract": "1.19.847",
+  "source_commit": "2f39aee80129563c843fb3b14b31a00db502f851",
   "source_ref": "HEAD",
-  "built_at": "2026-09-17T19:26:58.935Z",
+  "built_at": "2026-09-17T19:42:18.427Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 495,
+    "docs_redacted": 496,
     "agent_docs_stubbed": 26,
     "functional_verbatim": 2273,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2794,
-  "tree_sha256": "0ce103dd9544b2dc4d8ad8534a617c7e83884733163303d5eb381d4d44f49cb3",
+  "file_count": 2795,
+  "tree_sha256": "6e729d424a5377af457b9b765d44e5af905a4228a5f2df22ee259583224231a0",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2009,10 +2009,15 @@
       "mode": "0000644",
       "sha256": "62ffb9c1aeeaaafd5c51767f1ffff1c67adb3563e8d55ceb81ef77511184faa4"
     },
+    {
+      "path": "docs/adr/0304-routine-reads-run-without-a-prompt-and-anything-a-flag-can-turn-into-a-write-is-exact-form.md",
+      "mode": "0000644",
+      "sha256": "104b5675fe52c1725dbbc78ab6fde9fd676b4020bf0e3f05411733c95d4342e0"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "48323e44fced698a0da997eeb16564ab3b04430c8233a8f7997c0fec2b123401"
+      "sha256": "61dd72c5f0d4157062fb93585252448e5493afd25cb014fb747bf0e20037a2ab"
     },
     {
       "path": "docs/api-reference.md",
@@ -2577,7 +2582,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "d764a731750a2e1028c95a1fb94148e35ed3450b7394323d66c774959888105b"
+      "sha256": "6ba668dea0868f1ab54467d18278e494c3fc4eb121d19313c6d85d2c80d89e63"
     },
     {
       "path": "docs/modules-contract.md",
@@ -7902,12 +7907,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "4c1cac911818d09a26f42a791f1a2ce4a7add73cb38a8f7186ee0fd3d6425a3b"
+      "sha256": "6adf112f9a6622910cb13b7dd741da5a7d1c84976c286e13068974bb8717c629"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "d9c4e3866e590697c2a303536f799c9a7a99925295201df566d80e8c1b91f59f"
+      "sha256": "f7dc6b6b5522f7b4e1bddf7f62cd371fda49d1304497cb6b5de979c5f7a2ac93"
     },
     {
       "path": "public-docs/index.html",
@@ -8217,7 +8222,7 @@
     {
       "path": "scripts/gds/claude-materialize.js",
       "mode": "0000644",
-      "sha256": "53411af3a058d5fb22029a2ae923ef259fb1a45b1e39c20fd28e004a8c4d369f"
+      "sha256": "de8dcb51a250334621b104e99f7bc5f857f4422718c3c3ed8519cd5d0ebc8739"
     },
     {
       "path": "scripts/gds/claude-md-template.js",
@@ -9842,7 +9847,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "7ed9c1945c4d366375bd4009c00e90dbcfb847de0fc086bcd73e4fbf33589b36"
+      "sha256": "c2347ac91ce5aa5e5f46bcb3e0734bd151e2abbe1f2347290d75891229223a17"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10407,7 +10412,7 @@
     {
       "path": "tests/box_ship_permissions.mjs",
       "mode": "0000644",
-      "sha256": "5347fc776e8edb533223534707ddc7085af21654298d9d2169d711ecc5cfce2c"
+      "sha256": "063c94d759fa8a79b8c402145801ae2a4d9863bef591fb5adf57697e15effc39"
     },
     {
       "path": "tests/box_sync.mjs",
@@ -10562,7 +10567,7 @@
     {
       "path": "tests/claude_materialize.mjs",
       "mode": "0000644",
-      "sha256": "7acfe432856010881b234b258d45fcf65f976e0e711d01b823d90990a0c7179c"
+      "sha256": "42df08d261aaeb7cf94db3eef0e95b06af138d8d317b57f12dc4cb2c23d9f81a"
     },
     {
       "path": "tests/clawback_confirmed_backlog.mjs",

package/docs/adr/0304-routine-reads-run-without-a-prompt-and-anything-a-flag-can-turn-into-a-write-is-exact-form.md

@@ -0,0 +1,84 @@
+# ADR 0304 — Routine reads run without a prompt; anything a flag can turn into a write is exact-form
+
+**Status:** accepted · **Date:** 2026-09-17 · **Task:** [task 1003992](https://cloudbongos.com/builders#/task/1003992) (goal 1000095 — BONGOS-V2)
+
+**Related:** [ADR 0104](0104-trust-gds-api-channel-in-auto-mode.md) (the allow-list this extends — it named read wrappers as the next step) · [ADR 0016](0016-trust-boundary-server-enforced-permissions.md) (an allow-rule grants no authority) · [ADR 0043](0043-git-ssh-trust-boundary-and-rank-floor-on-permission-paths.md) (git-guard is the cooperative layer) · [ADR 0302](0302-the-third-identical-failure-stops-the-session-and-asks.md) (same investigation)
+
+## Context
+
+The shipped `.claude/settings.json` pre-allowed six commands. Much of what a session runs to look
+around — `gh pr view`, `git fetch origin`, `node scripts/gds/status.js` — stopped and asked the
+builder for permission. The 2026-09-17 investigation of a non-technical builder's stalls found
+this is a prompt they cannot evaluate: they are asked to approve a command they do not read, many
+times an hour, and the only safe answer they have is "yes". A prompt that is always answered yes
+protects nothing and teaches the builder to stop reading prompts.
+
+## Decision
+
+Pre-allow the **read-only subset**, in the core's `.claude/settings.json` and — rule for rule, in
+verb form — in the starter an instance receives (`STARTER_ALLOW`, task 1003962):
+
+- `git status` as a prefix rule.
+- `git branch` and `git fetch` as **exact forms only** (`git branch --list`, `--show-current`,
+  `-a`, `-vv`; `git fetch`, `git fetch origin`, `git fetch origin main`).
+- `gh pr view | checks | list` and `gh run view | list` as prefix rules.
+- The gds CLIs audited read-only under every flag they accept: `start`, `status`, `recall`, `me`,
+  `doctor`, `preflight`, `skill-preflight`, `ship-check`, `fitness`, `strand-watch`,
+  `stale-worktrees`, `read-session-export`. (`recall` POSTs, but to the search endpoint — a query.
+  `ship-check` and `fitness` run the repo's own checks, the same trust as the already-allowed
+  `ship.js`: a rule naming a script in the tree trusts the tree.) Audited and left out:
+  `backlog-review.js`, whose default walk POSTs promote / abandon, and `key-status.js`, whose
+  `--recheck` rewrites the local session file.
+
+**The rule behind the split.** `Bash(x:*)` is a prefix rule: it allows every flag that can follow
+`x`. So a command gets a prefix rule only when no flag turns it into a write or an exec.
+`git fetch --upload-pack=<cmd>` runs a command, `git fetch origin x:main` moves a local branch, and
+`git branch -D` deletes one — so those two subcommands are listed in the exact forms a session
+actually uses, and anything else under them still asks.
+
+**`git diff`, `git log` and `git show` get no rule at all.** The task asked for them, the first
+cut had them as prefix rules, and review caught what that did — both reproduced on this repo:
+`git log -1 --format=<text> --output=<path>` writes chosen content to any path (a
+`.git/hooks/pre-push` is code execution), and `git diff --no-index -- /dev/null <path>` prints any
+file, including the ones the `Read(...)` deny-list protects. Claude Code already runs the
+read-only forms of these commands without a prompt in every permission mode, and checks their
+flags when it does; an allow-rule is matched first and switches that check off. So for these three
+the rule bought nothing and cost the flag check. By this ADR's own test they fail it.
+
+**git-guard stays the backstop, and the lists are pinned.** A PreToolUse hook runs whether or not
+a command is pre-allowed, so git-guard still blocks its four shapes. `tests/box_ship_permissions.mjs`
+goes further: no allow-rule may *cover* a command git-guard blocks (blocked samples per guard rule;
+a new guard rule fails the suite until it has one); no allow-rule may cover a write dressed as a
+read (`--output`, `--no-index`, `--upload-pack`, a refspec); and the whole allow-list is pinned —
+every rule is a named gds script or one of the thirteen git/gh strings in the test — so
+widening it is a deliberate, reviewed edit.
+
+## Consequences
+
+- A session on a laptop or a box in auto mode reads PR and CI state, fetches, and runs the
+  read-only gds CLIs without interrupting the builder. `bypassPermissions` boxes are unaffected
+  (the rules are a no-op there).
+- An allow-rule matches the command text, not the program: it is a convenience, never a security
+  boundary. That is why the dangerous cases are handled by *not writing the rule* rather than by an
+  `ask` or `deny` pattern for `--output` — Claude Code's own docs note such argument patterns are
+  evaded by quoting (`--out''put`).
+- Rules are `Bash` only — the evidence is a hosted Linux box. `PowerShell(...)` twins are a
+  follow-up ([task 1004014](https://cloudbongos.com/builders#/task/1004014)), possible now that
+  [task 1003999](https://cloudbongos.com/builders#/task/1003999) has put that tool behind the same
+  guards; allowing first and guarding second was the wrong order.
+- An instance that already has a `.claude/settings.json` keeps its own; only a fresh starter carries
+  the new rules (the never-clobber rule of task 1003962).
+
+## Rejected
+
+- **`Bash(git:*)` or `Bash(gh:*)`.** One rule instead of thirteen, and it pre-allows `git push`,
+  `git reset --hard`, `gh pr merge` and `gh api -X DELETE`.
+- **Prefix rules for `git diff | log | show`, with `ask` rules for `--output` and `--no-index`.**
+  Evaluated in the order deny → ask → allow, so it works on the text a session normally writes — and
+  is evaded by quoting. The harness's built-in handling already covers the safe forms, so the pair
+  of rules would add a leaky guard to remove a prompt that does not exist.
+- **Prefix rules for `git fetch` / `git branch --list`.** `git branch --list -D x` is covered by the
+  prefix and blocked by git-guard — harmless in practice (git refuses the combination) but it makes
+  "nothing the guard blocks is allowed" false, and that sentence is worth keeping true.
+- **`bypassPermissions` everywhere** (task 1251's box default). It is a mode, not a list: a builder
+  who cycles modes or works from a laptop is back to prompts, and it removes the prompt for writes too.

package/docs/adr/README.md

@@ -395,3 +395,4 @@ This keeps the decision history honest and traceable.
 | 0301 | [**A red PR names its failing tests in a commit status, and says so when it cannot see** ([task 1003988](https://cloudbongos.com/builders#/task/1003988), goal 1000095). One pull request took nine red CI runs in four hours because the builder box could not learn which test failed: without Checks:read GitHub nulls every check-run node, the server dropped the holes silently, and the red PR was reported as a review-or-pending wait. Now the merge state carries checks_unreadable and a red, unreadable rollup reads failing_check_unreadable; the unit workflow posts the failing test names as a unit-report commit STATUS (readable without the permission) from a separate job that holds the only write token and checks out no PR code; the server returns it as failing_tests, reduced to test-list vocabulary because the PR controls the workflow that wrote it.](0301-a-red-pr-names-its-failing-tests-in-a-commit-status.md) | GDS / shipping pipeline |
 | 0302 | [**The third identical failure stops the session and asks** ([task 1003990](https://cloudbongos.com/builders#/task/1003990), goal 1000095). Sessions looped without noticing: one PR re-shipped into the same red check nine times, and 45 of 169 claim attempts were the same refusal retried minutes apart. A PostToolUse hook now counts walls per session — the signature is the `[otb-plain]` card's "What happened" line + the task id + the RED line, so a red check naming different failing tests each run reads as progress — and on the third identical one injects a single instruction: stop retrying, diagnose (path named), or /ask-for-help. Waiting cards ("Nothing to do…") are never counted; git-guard and worktree-guard count their own blocks through the same helper; it never blocks a tool call and echoes nothing a tool printed. Rejected: counting any repeated failing command (red→green is that), blocking the fourth attempt (a new gate, ADR 0162), server-side detection (cannot see guard blocks or speak into the session).](0302-the-third-identical-failure-stops-the-session-and-asks.md) | GDS / sessions / hooks |
 | 0303 | [**Provisioning verifies the base Caddyfile, and never edits it** ([task 1002860](https://cloudbongos.com/builders#/task/1002860), goal 1000106, from idea 1000524). The runner assumed the box's `/etc/caddy/Caddyfile` carried the `on_demand_tls` tls-check ask and `import /etc/caddy/sites/*.caddy`, and reloaded with `allowFail` — a box missing either provisioned "successfully" and the instance was unreachable. It now reads Caddy's RESOLVED config (`caddy adapt`: unprivileged, no key access, indifferent to how the directives are written) before touching the box (the ask) and after writing the snippet (the domain is served ⇒ the import reaches it), refusing with the exact line to add, and the reload is loud. Rejected: editing the base file (`on_demand_tls` must sit inside the global block an append cannot place, and a bad write takes down the control plane's own apex); `caddy validate` (loads certificate keys, needs root).](0303-provisioning-verifies-the-base-caddyfile-and-never-edits-it.md) | provisioning / infra |
+| 0304 | [**Routine reads run without a prompt; anything a flag can turn into a write is exact-form** ([task 1003992](https://cloudbongos.com/builders#/task/1003992), goal 1000095). The shipped `.claude/settings.json` pre-allowed six commands, so every `gh pr view` or `git fetch` asked a non-technical builder to approve a command they cannot evaluate. The read-only subset is now pre-allowed — `git status`, `gh pr view/checks/list`, `gh run view/list` and the gds CLIs audited read-only under every flag as prefix rules; `git branch` and `git fetch` as exact forms only, because a flag turns either into a write or an exec — and the instance starter mirrors it rule for rule. `git diff/log/show` get NO rule: the harness already runs their read-only forms unprompted with a flag check, and a prefix rule switched that check off (`--output=<path>` writes anywhere, `diff --no-index` reads deny-listed files — both reproduced in review). A test pins the whole allow-list, that no rule covers a command git-guard blocks, and that no rule covers a write dressed as a read. Rejected: `Bash(git:*)`, prefix-plus-`ask` for diff/log/show (argument patterns are evaded by quoting), prefix rules for fetch/branch, `bypassPermissions` everywhere.](0304-routine-reads-run-without-a-prompt-and-anything-a-flag-can-turn-into-a-write-is-exact-form.md) | GDS / sessions / permissions |

package/docs/module-api-changelog.md

@@ -2166,5 +2166,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.844 with no explicit bump. run 35263096514. (task 1002620)
   1.19.846 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.845 with no explicit bump. run 35264882014. (task 1002620)
+  1.19.847 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.846 with no explicit bump. run 35266409194. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.846",
+  "version": "1.19.847",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.846",
+      "version": "1.19.847",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.846",
+  "version": "1.19.847",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/claude-materialize.js

@@ -347,6 +347,37 @@ const STARTER_ALLOW = [
   'Bash(bongos reauth:*)',
   'Bash(bongos paste-token:*)',
   'Bash(bongos exec scripts/gds/api.js:*)',
+  // The read-only subset (task 1003992, ADR 0304). `git branch` and `git fetch`
+  // are exact forms on purpose: a flag turns either into a write or an exec. No
+  // `git diff|log|show` rule, also on purpose: the harness already runs their
+  // read-only forms unprompted, and a prefix rule would switch off its flag check
+  // (`--output=<file>` writes anywhere, `diff --no-index` reads any file).
+  // tests/box_ship_permissions.mjs pins this list to the core's, rule for rule.
+  'Bash(bongos start:*)',
+  'Bash(bongos status:*)',
+  'Bash(bongos recall:*)',
+  'Bash(bongos exec scripts/gds/me.js:*)',
+  'Bash(bongos doctor:*)',
+  'Bash(bongos exec scripts/gds/preflight.js:*)',
+  'Bash(bongos exec scripts/gds/skill-preflight.js:*)',
+  'Bash(bongos exec scripts/gds/ship-check.js:*)',
+  'Bash(bongos exec scripts/gds/fitness.js:*)',
+  'Bash(bongos exec scripts/gds/strand-watch.js:*)',
+  'Bash(bongos exec scripts/gds/stale-worktrees.js:*)',
+  'Bash(bongos exec scripts/gds/read-session-export.js:*)',
+  'Bash(git status:*)',
+  'Bash(git branch --list)',
+  'Bash(git branch --show-current)',
+  'Bash(git branch -a)',
+  'Bash(git branch -vv)',
+  'Bash(git fetch)',
+  'Bash(git fetch origin)',
+  'Bash(git fetch origin main)',
+  'Bash(gh pr view:*)',
+  'Bash(gh pr checks:*)',
+  'Bash(gh pr list:*)',
+  'Bash(gh run view:*)',
+  'Bash(gh run list:*)',
 ];
 
 // The starter an instance gets when the core root carries no settings.json — a

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.846'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.847'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/box_ship_permissions.mjs

@@ -12,11 +12,15 @@ import { strict as assert } from 'node:assert';
 import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { skipUnlessPresent } from './helpers.mjs';
+import { createRequire } from 'node:module';
+import { skipUnlessPresent, requireHostModule } from './helpers.mjs';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const settingsPath = path.join(__dirname, '..', '.claude', 'settings.json');
 skipUnlessPresent('.claude/settings.json');
+const require = createRequire(import.meta.url);
+const guard = requireHostModule(require, '../.claude/hooks/git-guard.js');
+const { STARTER_ALLOW, bongosify } = require('../scripts/gds/claude-materialize.js');
 
 let passed = 0, failed = 0;
 function test(name, fn) {
@@ -68,6 +72,131 @@ test('every allow-rule points at a script that actually exists (no inert rules)'
   }
 });
 
+// ---------------------------------------------------------------------------
+// task 1003992 — the read-only subset (ADR 0304). A non-technical builder was
+// interrupted for every `gh pr view` and `git fetch`; those are now pre-allowed.
+// An allow-rule skips the prompt, so the list must never reach a command
+// git-guard blocks, and must stay read-only.
+// ---------------------------------------------------------------------------
+
+// How Claude Code reads a Bash rule: `Bash(x:*)` covers x and anything starting
+// "x "; `Bash(x)` covers exactly x. A chained command is covered only when every
+// part is, so `git status && git stash` is not covered by a `git status` rule.
+function ruleCovers(rule, part) {
+  const m = rule.match(/^Bash\((.*?)(:\*)?\)$/);
+  if (!m) return false;
+  return part === m[1] || (Boolean(m[2]) && part.startsWith(`${m[1]} `));
+}
+function allowCovers(allow, command) {
+  const parts = command.split(/&&|\|\||[;|&\n]/).map((s) => s.trim()).filter(Boolean);
+  return parts.every((part) => allow.some((rule) => ruleCovers(rule, part)));
+}
+const isBlocked = (command) => guard.decide({ tool_name: 'Bash', tool_input: { command } }, {}).block;
+
+// At least one sample per git-guard rule, keyed by the rule's own name.
+const BLOCKED_SAMPLES = {
+  'git stash': ['git stash', 'git stash pop', 'git stash push -m wip', 'git status && git stash'],
+  'git worktree remove': ['git worktree remove ../wt', 'git worktree remove --force ../wt'],
+  'git push origin main': ['git push origin main', 'git push -u origin HEAD:main', 'git push --force origin task-1:main'],
+  'git branch -D': ['git branch -D task-1', 'git branch --list -D task-1', 'git branch -a -D task-1'],
+};
+
+test('every git-guard rule has blocked samples here (a new rule forces a new sample)', () => {
+  for (const [name] of guard.RULES) {
+    assert.ok((BLOCKED_SAMPLES[name] || []).length, `no blocked sample for git-guard rule "${name}"`);
+  }
+  for (const samples of Object.values(BLOCKED_SAMPLES)) {
+    for (const cmd of samples) assert.ok(isBlocked(cmd), `sample is not actually blocked by git-guard: ${cmd}`);
+  }
+});
+
+test('no allow-rule covers a command git-guard blocks', () => {
+  const allow = settings.permissions.allow;
+  for (const rule of allow) {
+    const text = rule.replace(/^Bash\(/, '').replace(/(:\*)?\)$/, '');
+    assert.ok(!isBlocked(text), `allow-rule is itself a git-guard-blocked command: ${rule}`);
+  }
+  for (const cmd of Object.values(BLOCKED_SAMPLES).flat()) {
+    assert.ok(!allowCovers(allow, cmd), `an allow-rule covers a git-guard-blocked command: ${cmd}`);
+  }
+});
+
+test('the check has teeth: a too-broad git rule IS caught', () => {
+  const samples = Object.values(BLOCKED_SAMPLES).flat();
+  for (const broad of ['Bash(git:*)', 'Bash(git stash:*)', 'Bash(git worktree:*)', 'Bash(git push:*)', 'Bash(git branch:*)', 'Bash(git branch --list:*)']) {
+    assert.ok(samples.some((cmd) => allowCovers([broad], cmd)), `${broad} should cover a blocked sample`);
+  }
+});
+
+// The whole git/gh allow-list, pinned. A flag can turn a read into a write or an
+// exec (`git fetch --upload-pack=<cmd>`, `git fetch origin x:main`, `git branch -D`),
+// so `branch` and `fetch` appear only as the exact commands a session runs.
+//
+// NO `git diff|log|show` rule, on purpose. Claude Code already runs their read-only
+// forms without a prompt in every mode and checks their flags; a prefix rule would
+// switch that check off (see WRITES_DRESSED_AS_READS below — both were reproduced).
+const GIT_GH_RULES = [
+  'Bash(git status:*)',
+  'Bash(git branch --list)', 'Bash(git branch --show-current)', 'Bash(git branch -a)', 'Bash(git branch -vv)',
+  'Bash(git fetch)', 'Bash(git fetch origin)', 'Bash(git fetch origin main)',
+  'Bash(gh pr view:*)', 'Bash(gh pr checks:*)', 'Bash(gh pr list:*)', 'Bash(gh run view:*)', 'Bash(gh run list:*)',
+];
+// gds CLIs audited read-only under EVERY flag they take — a prefix rule allows them all.
+// Audited and left OUT: backlog-review.js (POSTs from its default walk) and
+// key-status.js (`--recheck` rewrites the local session file).
+const READ_ONLY_CLIS = ['start', 'status', 'recall', 'me', 'doctor', 'preflight', 'skill-preflight',
+  'ship-check', 'fitness', 'strand-watch', 'stale-worktrees', 'read-session-export'];
+const BLESSED_WRITERS = ['ship', 'claim', 'reauth', 'release', 'paste-token', 'api']; // tasks 1051 / 1716
+
+const SCRIPT_RULE = /^Bash\(node scripts\/gds\/([a-z-]+)\.js:\*\)$/;
+
+test('every allow-rule that is not a gds script is in the pinned git/gh set (adding one is a deliberate edit here)', () => {
+  // Catches `Bash(gh:*)`, `Bash(gh *)`, `Bash(git -C x status:*)`, a bare `Bash` — anything unlisted.
+  const rest = settings.permissions.allow.filter((rule) => !SCRIPT_RULE.test(rule));
+  assert.deepEqual([...rest].sort(), [...GIT_GH_RULES].sort());
+});
+
+// "Read" commands whose flags write a file, read one the Read deny-list protects,
+// run a command, or move a branch. None may ever run without a prompt.
+const WRITES_DRESSED_AS_READS = [
+  "git log -1 --format='#!/bin/sh' --output=.git/hooks/pre-push",
+  'git show --output=/tmp/x HEAD',
+  'git diff --output=/tmp/x',
+  'git diff --no-index -- /dev/null .env',
+  'git fetch --upload-pack=./x origin',
+  'git fetch origin task-1:main',
+];
+
+test('no allow-rule lets a write dressed as a read through (--output, --no-index, --upload-pack, a refspec)', () => {
+  for (const cmd of WRITES_DRESSED_AS_READS) {
+    assert.ok(!allowCovers(settings.permissions.allow, cmd), `runs without a prompt: ${cmd}`);
+  }
+  // Teeth: the prefix rules this list deliberately does NOT carry would let them through.
+  const tempting = ['Bash(git log:*)', 'Bash(git show:*)', 'Bash(git diff:*)', 'Bash(git fetch:*)'];
+  for (const cmd of WRITES_DRESSED_AS_READS) assert.ok(allowCovers(tempting, cmd), `teeth: ${cmd}`);
+});
+
+test('every gds-script allow-rule is a blessed writer or an audited read-only CLI', () => {
+  const known = new Set([...BLESSED_WRITERS, ...READ_ONLY_CLIS]);
+  for (const rule of settings.permissions.allow) {
+    const m = rule.match(SCRIPT_RULE);
+    if (m) assert.ok(known.has(m[1]), `${m[1]}.js is pre-allowed but not audited here — a prefix rule allows every flag it takes`);
+  }
+});
+
+test('the read-only subset is pre-allowed', () => {
+  const allow = settings.permissions.allow;
+  for (const cmd of ['git status', 'git status --short', 'git branch --list', 'git fetch origin',
+    'gh pr view 922', 'gh pr checks 922', 'gh pr list', 'gh run view 1 --log-failed', 'gh run list --limit 5',
+    ...READ_ONLY_CLIS.map((s) => `node scripts/gds/${s}.js`)]) {
+    assert.ok(allowCovers(allow, cmd), `should run without a prompt: ${cmd}`);
+  }
+});
+
+test('the instance starter mirrors this list in verb form (claude-materialize.js STARTER_ALLOW)', () => {
+  assert.deepEqual([...STARTER_ALLOW].sort(), settings.permissions.allow.map((rule) => bongosify(rule)).sort());
+});
+
 console.log('');
 console.log(`box_ship_permissions: ${passed} passed, ${failed} failed`);
 process.exit(failed === 0 ? 0 : 1);

package/tests/claude_materialize.mjs

@@ -729,6 +729,7 @@ t('every allow-rule names a verb the CLI actually registers', () => {
   // is silently inert — it looks like a permission and grants nothing, so the
   // builder still meets the classifier and nobody can see why.
   for (const rule of m.STARTER_ALLOW) {
+    if (!rule.startsWith('Bash(bongos ')) continue; // the git/gh reads (task 1003992) name no verb
     const inner = rule.replace(/^Bash\(/, '').replace(/:\*\)$/, '');
     const verb = inner.split(' ')[1];
     assert.ok(cliVerbs[verb], `allow-rule "${rule}" names "${verb}", which is not a registered bongos verb`);