@deftai/directive-core 0.107.0 → 0.109.0

package/dist/hooks/classify/stdin.js

@@ -2,13 +2,42 @@
  * Pure stdin → payload parse for hook-dispatch (#2734 / #2738 / #2950).
  * No process I/O — operates on an already-read string.
  */
+import { firstString, record, toolInputRecord } from "./payload.js";
 const UTF8_BOM = "\uFEFF";
 const APPLY_PATCH_BEGIN_MARKER = "*** Begin Patch";
 /** Single-file Add/Update only — other *** … File: ops must fail closed (#2738 Greptile). */
 const APPLY_PATCH_MUTATION_LINE_RE = /^\*\*\* (Add File|Update File|Delete File|Move File|Rename File): (.+)$/gm;
+/**
+ * Canonical apply_patch spells a rename as `*** Update File:` followed by
+ * `*** Move to:`. The destination is a mutation target in its own right, so it
+ * must reach root admission. Synthesis refuses when applyPatchMutationPaths
+ * reports more than one unique path, so a Move-to destination is not dropped
+ * from the single-target contract (#3614 / #3794).
+ */
+const APPLY_PATCH_MOVE_DESTINATION_RE = /^\*\*\* Move to: (.+)$/gm;
 export function stripUtf8Bom(raw) {
     return raw.startsWith(UTF8_BOM) ? raw.slice(UTF8_BOM.length) : raw;
 }
+/**
+ * Paths named by ApplyPatch mutation headers, plus `*** Move to:` rename
+ * destinations. Order preserved, duplicates dropped.
+ */
+export function applyPatchMutationPaths(text) {
+    const paths = [];
+    const seen = new Set();
+    const push = (raw) => {
+        const path = raw?.trim();
+        if (!path || seen.has(path))
+            return;
+        seen.add(path);
+        paths.push(path);
+    };
+    for (const match of text.matchAll(APPLY_PATCH_MUTATION_LINE_RE))
+        push(match[2]);
+    for (const match of text.matchAll(APPLY_PATCH_MOVE_DESTINATION_RE))
+        push(match[1]);
+    return paths;
+}
 function trySynthesizeFreeFormApplyPatch(normalized) {
     if (!normalized.includes(APPLY_PATCH_BEGIN_MARKER))
         return null;
@@ -22,6 +51,10 @@ function trySynthesizeFreeFormApplyPatch(normalized) {
     }
     if (mutations.length !== 1)
         return null;
+    // Count headers plus Move-to destinations so a rename cannot collapse to one
+    // checked path (#3614 / #3794). Reuses applyPatchMutationPaths; no second parser.
+    if (applyPatchMutationPaths(normalized).length !== 1)
+        return null;
     const sole = mutations[0];
     if (sole === undefined || (sole.op !== "Add File" && sole.op !== "Update File"))
         return null;
@@ -36,6 +69,65 @@ function trySynthesizeFreeFormApplyPatch(normalized) {
         context: {},
     };
 }
+function declaredWritePathFromParsed(payload) {
+    const input = record(payload);
+    if (input === null)
+        return null;
+    const toolInput = toolInputRecord(input);
+    return firstString([
+        toolInput?.file_path,
+        toolInput?.filePath,
+        toolInput?.path,
+        input.file_path,
+        input.filePath,
+        input.path,
+    ]);
+}
+function applyPatchBodyTextFromParsed(payload) {
+    const input = record(payload);
+    if (input === null)
+        return null;
+    const toolInput = toolInputRecord(input);
+    return firstString([
+        toolInput?.patch,
+        toolInput?.unified_diff,
+        toolInput?.diff,
+        input.patch,
+        input.unified_diff,
+        input.diff,
+    ]);
+}
+function withToolInputPath(parsed, path) {
+    const input = record(parsed);
+    if (input === null)
+        return parsed;
+    for (const key of ["tool_input", "toolInput", "input", "arguments"]) {
+        const nested = record(input[key]);
+        if (nested !== null) {
+            return { ...input, [key]: { ...nested, path } };
+        }
+    }
+    return { ...input, tool_input: { path } };
+}
+/**
+ * Valid-JSON hosts (Codex) never hit the JSON.parse catch arm, so the free-form
+ * extractor was unreached. Call it on the patch body when no path was declared.
+ * Does not replace the parsed payload; only fills tool_input.path.
+ */
+function attachSynthesizedApplyPatchPath(parsed) {
+    if (declaredWritePathFromParsed(parsed) !== null)
+        return parsed;
+    const patch = applyPatchBodyTextFromParsed(parsed);
+    if (patch === null)
+        return parsed;
+    const synthesized = trySynthesizeFreeFormApplyPatch(patch);
+    if (synthesized === null)
+        return parsed;
+    const synthesizedPath = declaredWritePathFromParsed(synthesized.payload);
+    if (synthesizedPath === null)
+        return parsed;
+    return withToolInputPath(parsed, synthesizedPath);
+}
 /**
  * Parse host hook stdin text into a payload + parse context.
  * Empty → stdinEmpty; invalid JSON without free-form ApplyPatch → parseFailed.
@@ -49,7 +141,8 @@ export function parseHookStdin(raw) {
         return { payload: {}, context: { stdinEmpty: true } };
     }
     try {
-        return { payload: JSON.parse(normalized), context: {} };
+        const parsed = JSON.parse(normalized);
+        return { payload: attachSynthesizedApplyPatchPath(parsed), context: {} };
     }
     catch {
         const synthesized = trySynthesizeFreeFormApplyPatch(normalized);

package/dist/hooks/dest-form.d.ts

@@ -12,13 +12,27 @@
  * *forms* instead, and see `content/contracts/path-write-fence.md`.
  *
  * Residual known-open (recognition, not resolution): `python -c`,
- * `cmd /c copy`, obfuscated `bash -c`.
+ * `cmd /c copy`, obfuscated `bash -c`. Tree-wide destructive git
+ * (`reset --hard`, `clean -f`, `checkout -f`/`switch -f`, `stash drop`/`clear`)
+ * is classified separately by {@link classifyGitDestructive} and is always
+ * fail-closed at the dispatcher, independent of `shellDestForms`.
  *
  * Commit-time active-scope is out of this slice (#3438), and ⊗ do not weaken
  * Edit to match Shell. Keep this sentence on ONE line: acceptance clause 4 is
  * verified by a literal token search, so wrapping it silently fails the gate.
  */
 export type ProductDestFormKind = "git-checkout" | "git-restore" | "rm" | "rmdir";
+export type GitDestructiveKind = "git-reset-hard" | "git-clean" | "git-checkout-force" | "git-stash-drop";
+export interface GitDestructiveForm {
+    readonly kind: GitDestructiveKind;
+    /** Relocating context paths from `-C` / `--git-dir` / `--work-tree` / `GIT_DIR` / `GIT_WORK_TREE`. */
+    readonly relocators: readonly string[];
+    /**
+     * True when the command is compound or the relocator is opaque (`GIT_CONFIG*`,
+     * `-c core.workTree`). The dispatcher denies these; it cannot prove a fixture.
+     */
+    readonly unprovable: boolean;
+}
 export interface ProductDestForm {
     readonly kind: ProductDestFormKind;
     readonly path: string;
@@ -43,4 +57,9 @@ export declare function payloadWithInjectedWriteTarget(payload: unknown, destPat
  */
 export declare function destFormHasExpansion(path: string): boolean;
 export declare function classifyProductDestForms(command: string): ProductDestForm[];
+/**
+ * Tree-wide destructive git — always-on at the dispatcher, not behind
+ * `shellDestForms`. Empty when the command is not one of those forms.
+ */
+export declare function classifyGitDestructive(command: string): GitDestructiveForm[];
 //# sourceMappingURL=dest-form.d.ts.map

package/dist/hooks/dest-form.js

@@ -12,7 +12,10 @@
  * *forms* instead, and see `content/contracts/path-write-fence.md`.
  *
  * Residual known-open (recognition, not resolution): `python -c`,
- * `cmd /c copy`, obfuscated `bash -c`.
+ * `cmd /c copy`, obfuscated `bash -c`. Tree-wide destructive git
+ * (`reset --hard`, `clean -f`, `checkout -f`/`switch -f`, `stash drop`/`clear`)
+ * is classified separately by {@link classifyGitDestructive} and is always
+ * fail-closed at the dispatcher, independent of `shellDestForms`.
  *
  * Commit-time active-scope is out of this slice (#3438), and ⊗ do not weaken
  * Edit to match Shell. Keep this sentence on ONE line: acceptance clause 4 is
@@ -113,13 +116,14 @@ export function classifyProductDestForms(command) {
     // bypass.
     //
     // ⊗ Recognition is NOT total either, and this is not a security boundary.
-    // Only four verbs are recognized, and a non-literal verb (`\rm`, `rm${IFS}x`)
-    // defeats the tokenizer, so the fail-closed branch below only fires when the
-    // verb is still legible. Unrecognized mutators (`git reset --hard`,
-    // `git clean`, `git checkout` without `--`, `mv`, `sed -i`, `>` redirection)
-    // and interpreters (`bash -c`, `python -c`) are fail-OPEN. See the threat
-    // model in content/contracts/path-write-fence.md: this is a guardrail for
-    // careless agents, not a boundary against adversarial ones.
+    // Only four dest-form verbs are recognized, and a non-literal verb (`\rm`,
+    // `rm${IFS}x`) defeats the tokenizer, so the fail-closed branch below only
+    // fires when the verb is still legible. Tree-wide destructive git is handled
+    // by classifyGitDestructive (always-on). Remaining fail-OPEN mutators:
+    // `git checkout` without `--` or `-f`, `mv`, `sed -i`, `>` redirection, and
+    // interpreters (`bash -c`, `python -c`). See the threat model in
+    // content/contracts/path-write-fence.md: this is a guardrail for careless
+    // agents, not a boundary against adversarial ones.
     if (segments.length === 1 && !hasUnsupportedSyntax(cmd)) {
         return classifySimpleDestForms(segments[0] ?? "");
     }
@@ -136,6 +140,29 @@ export function classifyProductDestForms(command) {
         expansion: true,
     }));
 }
+/**
+ * Tree-wide destructive git — always-on at the dispatcher, not behind
+ * `shellDestForms`. Empty when the command is not one of those forms.
+ */
+export function classifyGitDestructive(command) {
+    const cmd = command.trim();
+    if (cmd.length === 0)
+        return [];
+    const segments = splitCommandSegments(cmd);
+    const compound = segments.length > 1 || hasUnsupportedSyntax(cmd);
+    const found = [];
+    const seen = new Set();
+    for (const seg of segments) {
+        const form = classifyGitDestructiveSegment(seg);
+        if (form === null)
+            continue;
+        if (seen.has(form.kind))
+            continue;
+        seen.add(form.kind);
+        found.push(compound ? { ...form, unprovable: true } : form);
+    }
+    return found;
+}
 /** Classify one command with no operators, no grouping, and no substitution. */
 function classifySimpleDestForms(segment) {
     const found = [];
@@ -334,9 +361,33 @@ function isGitWorkTreeAssign(token) {
     // A config FILE override can set core.worktree out of sight.
     return key === "GIT_CONFIG" || key === "GIT_CONFIG_GLOBAL" || key === "GIT_CONFIG_SYSTEM";
 }
+function gitDirOrWorkTreeValue(token) {
+    const eq = token.indexOf("=");
+    if (eq <= 0)
+        return null;
+    const key = token.slice(0, eq);
+    const value = token.slice(eq + 1);
+    if ((key === "GIT_WORK_TREE" || key === "GIT_DIR") && value.length > 0)
+        return value;
+    return null;
+}
 function skipPrefix(tokens) {
     let i = 0;
     let gitContext = false;
+    let opaqueContext = false;
+    const relocators = [];
+    const noteAssign = (tok) => {
+        const reloc = gitDirOrWorkTreeValue(tok);
+        if (reloc !== null) {
+            gitContext = true;
+            relocators.push(reloc);
+            return;
+        }
+        if (isGitWorkTreeAssign(tok)) {
+            gitContext = true;
+            opaqueContext = true;
+        }
+    };
     const consumeAssigns = () => {
         while (i < tokens.length) {
             const tok = tokens[i];
@@ -351,8 +402,7 @@ function skipPrefix(tokens) {
             }
             if (!isEnvAssign(tok))
                 break;
-            if (isGitWorkTreeAssign(tok))
-                gitContext = true;
+            noteAssign(tok);
             i++;
         }
     };
@@ -380,15 +430,14 @@ function skipPrefix(tokens) {
                 continue;
             }
             if (isEnvAssign(tok)) {
-                if (isGitWorkTreeAssign(tok))
-                    gitContext = true;
+                noteAssign(tok);
                 i++;
                 continue;
             }
             break;
         }
     }
-    return { i, gitContext };
+    return { i, gitContext, relocators, opaqueContext };
 }
 /**
  * Skip git's global options, reporting whether any of them RELOCATES the work
@@ -400,31 +449,51 @@ function skipPrefix(tokens) {
 function skipGitGlobals(tokens, start) {
     let i = start;
     let gitContext = false;
+    let opaqueContext = false;
+    const relocators = [];
     while (i < tokens.length) {
         const t = tokens[i];
         if (t === undefined || !t.startsWith("-"))
-            return { i, gitContext };
+            return { i, gitContext, relocators, opaqueContext };
         if (t === "-c" || t === "--config-env") {
-            if (isCoreWorkTreeConfig(tokens[i + 1]))
+            if (isCoreWorkTreeConfig(tokens[i + 1])) {
                 gitContext = true;
+                opaqueContext = true;
+            }
             i += 2;
             continue;
         }
         if (t.startsWith("--config-env=")) {
-            if (isCoreWorkTreeConfig(t.slice("--config-env=".length)))
+            if (isCoreWorkTreeConfig(t.slice("--config-env=".length))) {
                 gitContext = true;
+                opaqueContext = true;
+            }
             i++;
             continue;
         }
         if (t === "-C" || t === "--work-tree" || t === "--git-dir") {
             gitContext = true;
+            const val = tokens[i + 1];
+            if (val !== undefined)
+                relocators.push(val);
             i += 2;
             continue;
         }
-        if (t.startsWith("--work-tree=") ||
-            t.startsWith("--git-dir=") ||
-            (t.startsWith("-C") && t.length > 2)) {
+        if (t.startsWith("--work-tree=")) {
+            gitContext = true;
+            relocators.push(t.slice("--work-tree=".length));
+            i++;
+            continue;
+        }
+        if (t.startsWith("--git-dir=")) {
             gitContext = true;
+            relocators.push(t.slice("--git-dir=".length));
+            i++;
+            continue;
+        }
+        if (t.startsWith("-C") && t.length > 2) {
+            gitContext = true;
+            relocators.push(t.slice(2));
             i++;
             continue;
         }
@@ -437,14 +506,16 @@ function skipGitGlobals(tokens, start) {
             continue;
         }
         if (t.startsWith("-c")) {
-            if (isCoreWorkTreeConfig(t.slice(2)))
+            if (isCoreWorkTreeConfig(t.slice(2))) {
                 gitContext = true;
+                opaqueContext = true;
+            }
             i++;
             continue;
         }
         i++;
     }
-    return { i, gitContext };
+    return { i, gitContext, relocators, opaqueContext };
 }
 function pathsAfterDashDash(tokens, start) {
     const dash = tokens.indexOf("--", start);
@@ -469,6 +540,72 @@ function dests(kind, paths, unsafe = false) {
         .filter((path) => path.length > 0)
         .map((path) => (unsafe ? { kind, path, expansion: true } : { kind, path }));
 }
+function tokensHaveFlag(tokens, start, names) {
+    for (let i = start; i < tokens.length; i++) {
+        const t = tokens[i];
+        if (t === undefined)
+            break;
+        if (names.has(t))
+            return true;
+        for (const name of names) {
+            if (name.startsWith("--") && t.startsWith(`${name}=`))
+                return true;
+        }
+    }
+    return false;
+}
+function tokensHaveShortForce(tokens, start) {
+    for (let i = start; i < tokens.length; i++) {
+        const t = tokens[i];
+        if (t === undefined || t === "--")
+            break;
+        if (t === "-f" || t === "-B")
+            return true;
+        if (t.startsWith("-") && !t.startsWith("--") && t.includes("f"))
+            return true;
+    }
+    return false;
+}
+function classifyGitDestructiveSegment(segment) {
+    const tokens = tokenizeSegment(segment.trim());
+    const prefixSkip = skipPrefix(tokens);
+    let i = prefixSkip.i;
+    const binRaw = tokens[i];
+    if (binRaw === undefined)
+        return null;
+    const bin = binRaw.replace(/^[({!]+/, "").toLowerCase();
+    if (bin !== "git" && bin !== "git.exe")
+        return null;
+    const skipped = skipGitGlobals(tokens, i + 1);
+    i = skipped.i;
+    const sub = tokens[i]?.toLowerCase();
+    if (sub === undefined)
+        return null;
+    let kind = null;
+    if (sub === "reset" && tokensHaveFlag(tokens, i + 1, new Set(["--hard"]))) {
+        kind = "git-reset-hard";
+    }
+    else if (sub === "clean" &&
+        (tokensHaveFlag(tokens, i + 1, new Set(["--force", "-f"])) ||
+            tokensHaveShortForce(tokens, i + 1))) {
+        kind = "git-clean";
+    }
+    else if ((sub === "checkout" || sub === "switch") &&
+        (tokensHaveFlag(tokens, i + 1, new Set(["--force", "-f", "-B"])) ||
+            tokensHaveShortForce(tokens, i + 1))) {
+        kind = "git-checkout-force";
+    }
+    else if (sub === "stash") {
+        const action = tokens[i + 1]?.toLowerCase();
+        if (action === "drop" || action === "clear")
+            kind = "git-stash-drop";
+    }
+    if (kind === null)
+        return null;
+    const relocators = [...prefixSkip.relocators, ...skipped.relocators];
+    const opaque = prefixSkip.opaqueContext || skipped.opaqueContext;
+    return { kind, relocators, unprovable: opaque };
+}
 /**
  * `-c core.workTree=...` / `--config-env` relocates the work tree through git
  * config. Resolution depends on the git dir, which this classifier does not

package/dist/hooks/dispatcher.d.ts

@@ -7,7 +7,7 @@ import { type DetectWorkSelection, type RitualRunner, type VerifyResult } from "
 import { type HookPayloadContext } from "./classify/index.js";
 import { type ActiveScopeInspection } from "./scope.js";
 export { ASSIST_SESSION_POSTURE_ENV, hookReadOnlyFromPayload, isAssistPosture, isEphemeralSpawn, isExploreSpawn, isReadOnlyHookContext, } from "./readonly.js";
-export { DIRECT_WRITE_HOOK_MATCHER, DIRECT_WRITE_TOOL_NAMES, isDirectWriteTool, isMcpTool, isShellTool, isSpawnTool, MCP_HOOK_MATCHER, MCP_PUSH_MERGE_BARE_NAMES, READ_ONLY_HOOK_ENV, SHELL_HOOK_MATCHER, SHELL_TOOL_NAMES, SPAWN_HOOK_MATCHER, SPAWN_TOOL_NAMES, } from "./tools.js";
+export { DIRECT_WRITE_HOOK_MATCHER, DIRECT_WRITE_TOOL_NAMES, GROK_MUTATION_TOOL_CATALOG, GROK_NON_MUTATION_TOOLS, isDirectWriteTool, isMcpTool, isShellTool, isSpawnTool, MCP_HOOK_MATCHER, MCP_PUSH_MERGE_BARE_NAMES, matcherHasLiteralToken, READ_ONLY_HOOK_ENV, SHELL_HOOK_MATCHER, SHELL_TOOL_NAMES, SPAWN_HOOK_MATCHER, SPAWN_TOOL_NAMES, } from "./tools.js";
 export declare const HOOK_HOSTS: readonly ["claude", "grok", "cursor", "codex"];
 export type HookHost = (typeof HOOK_HOSTS)[number];
 export declare const HOOK_EVENTS: readonly ["session.start", "session.compact", "tool.before"];
@@ -24,7 +24,15 @@ export type HookDecisionCode = "session-start" | "session-start-disabled" | "ses
 /** Host closed stdin with zero bytes — integration failure, not a policy gate (#2864). */
  | "stdin-empty" | "ritual-not-ready"
 /** Product-path write while another live session occupies this worktree (#3433). */
- | "occupancy-occupied" | "scope-not-ready" | "write-propose-ready"
+ | "occupancy-occupied"
+/** A supported host omitted or malformed its cooperative payload owner (#3611). */
+ | "occupancy-identity-unavailable"
+/** Host payload identity conflicts with explicit/environment identity (#3611). */
+ | "occupancy-identity-conflict"
+/** Live lease and exact verified ritual state name different owners (#3611). */
+ | "occupancy-ritual-mismatch"
+/** Write target resolved to a Git repository that does not share git-common-dir (#3794). */
+ | "foreign-repository-deny" | "scope-not-ready" | "write-propose-ready"
 /** Allowlisted assist/scratch write without active xBRIEF (#1802). */
  | "write-assist-scratch-ready" | "write-ready" | "read-only-deny" | "spawn-explore-ready"
 /** Non-lifecycle assist/docs spawn allowed without active xBRIEF (#3080). */
@@ -36,7 +44,11 @@ export type HookDecisionCode = "session-start" | "session-start-disabled" | "ses
 /** UAT lease / human-origin grant denial (#2944). */
  | "authz-uat-deny" | "authz-grant-missing" | "authz-grant-origin-reject" | "authz-grant-scope-deny" | "authz-grant-expired" | "authz-grant-revoked" | "authz-grant-single-use-spent"
 /** Slash-command intent ceiling denial (#1193). */
- | "intent-ceiling-deny";
+ | "intent-ceiling-deny"
+/** Tree-wide destructive git aimed at this checkout (#3917). */
+ | "git-destructive-deny"
+/** Tree-wide destructive git aimed at an absolute out-of-root fixture (#3917). */
+ | "git-destructive-fixture";
 export interface HookDecision {
     readonly verdict: HookVerdict;
     readonly code: HookDecisionCode;
@@ -46,6 +58,8 @@ export interface HookDecision {
     readonly projectRoot: string;
     readonly message: string;
     readonly scopePath: string | null;
+    /** Complete host tool input replacement for an exact lifecycle command (#3611). */
+    readonly updatedInput?: Readonly<Record<string, unknown>>;
 }
 export interface HookDispatchInput {
     readonly host: HookHost;
@@ -106,6 +120,12 @@ export interface HookPolicySeams {
     readonly loadAuthzGrants?: (projectRoot: string, state: AuthzState) => readonly HumanOriginGrant[];
     /** When false, skip writing `.deft/authz/audit.jsonl` (tests). Default true. */
     readonly authzAudit?: boolean;
+    /** Test seam for restricting Task lifecycle rewrites to the Directive source repo. */
+    readonly runningInsideDeftRepo?: (projectRoot: string) => boolean;
+    /** Test seam for execution-root realpath binding in lifecycle rewrites. */
+    readonly realpathLifecycleExecutionRoot?: (path: string) => string;
+    /** Test seam for Windows drive-only execution-root payloads (#2787). */
+    readonly lifecycleExecutionPlatform?: NodeJS.Platform;
 }
 /** POSIX-ish project-relative path for lifecycle matching. */
 export declare function toProjectRelativePosix(projectRoot: string, targetPath: string): string;
@@ -153,6 +173,41 @@ export declare function isAssistScratchWrite(projectRoot: string, targetPath: st
 /** Normalize hook project-root resolution on Windows (doubled drive + MSYS `/c/...`). */
 export declare function normalizeHookProjectRoot(path: string): string;
 export declare function projectRootFromHookPayload(payload: unknown, fallback: string): string;
+/** Interpolate both roots so a deny names the tree that was judged (#3794). */
+export declare function formatHookRootNote(payloadRoot: string, effectiveRoot: string): string;
+/** Why a mutation target was refused, so the deny message can be specific (#3794). */
+export type EffectiveHookRootRefusal = 
+/** Both common-dirs resolved and differ: a proven separate repository. */
+"foreign-repository"
+/** `payloadRoot` is a repository but the target's identity could not be read. */
+ | "unproven-identity"
+/** Members of one mutation resolved to two admitted worktrees. */
+ | "worktree-span";
+export interface EffectiveHookRootAdmission {
+    readonly root: string;
+    /** True when the target was refused and the dispatcher must deny (#3794). */
+    readonly foreign: boolean;
+    readonly candidate: string | null;
+    readonly refusal: EffectiveHookRootRefusal | null;
+}
+/**
+ * Admit the Git toplevel of the write target only when it shares
+ * `--git-common-dir` with `payloadRoot`.
+ *
+ * Identity resolves to one of three outcomes, not two. A `payloadRoot` that is
+ * not a Git repository never posed a containment question, so it keeps today's
+ * payloadRoot gating. A `payloadRoot` that *is* a repository, paired with a
+ * target that resolved to some other toplevel whose identity cannot be read, is
+ * a question asked and left unanswered — that fails closed rather than
+ * inheriting payloadRoot's occupancy and ritual state (#3794).
+ */
+export declare function admitEffectiveHookRoot(payloadRoot: string, writeTarget: string | null, runGit: GitRunner): EffectiveHookRootAdmission;
+/**
+ * Admit every mutation target and require one effectiveRoot. A refused member
+ * short-circuits; a span of two admitted worktrees is also refused so
+ * occupancy/ritual cannot follow only the declared ApplyPatch path (#3794).
+ */
+export declare function admitMutationTargetSet(payloadRoot: string, targets: readonly string[], runGit: GitRunner): EffectiveHookRootAdmission;
 export declare function isHookHost(value: string): value is HookHost;
 export declare function isHookEvent(value: string): value is HookEvent;
 /** Decide a normalized event using only the P0 direct-write policy. */