@event4u/agent-config 14.14.1 → 14.16.0

package/src/scripts/git_authorization_hook.ts

@@ -25,11 +25,27 @@
  *   { "session_id": str, "detected_at": iso8601, "authorized": [op, …],
  *     "evidence": { op: "phrase" }, "prompt_chars": int }
  *
- * Each user turn REPLACES the ledger — that is the point. `commit-policy`'s
+ * Each user turn REPLACES `authorized` — that is the point. `commit-policy`'s
  * "one-shot authorization is not a standing license" says an authorization is
  * spent on the operation it named; carrying it forward is the exact inference
  * the rule forbids, so a new prompt with no authorization phrase yields an
- * empty ledger rather than an inherited one.
+ * empty `authorized` list rather than an inherited one.
+ *
+ * **`grants` are the one exception, and they are narrower, not broader**
+ * (ADR-252, 2026-09-03). A bare operation name says *the user wants a merge*;
+ * a grant says *the user wants THESE pull requests merged*, with the numbers
+ * frozen from the user's own sentence at mint time and each spent on first use.
+ * Because the objects are fixed, elapsed time is no longer what protects the
+ * user — target identity is — so a grant survives later turns and carries no
+ * clock, while everything without frozen objects keeps both the replacement
+ * rule above and the guard's 30-minute freshness bound.
+ *
+ * The measured defect this fixes: a neutral follow-up ("weiter", "fix the CI")
+ * replaced the whole ledger and silently erased a merge authorization the user
+ * had given two turns earlier, so a multi-PR run the user explicitly ordered
+ * became unexecutable without re-typing the order every 30 minutes. Two
+ * hand-widenings of the guard's clock (2026-08-21, 2026-08-30) are what that
+ * pressure produced instead.
  *
  * Never blocks. Exit 0 always. The blocking half lives in the pre_tool_use
  * concern, which is where the operation is actually observable.
@@ -170,7 +186,51 @@ export type GitOp =
   | "pr-merge-auto"
   | "tag"
   | "release"
-  | "publish";
+  | "publish"
+  // ── Added 2026-09-03. Measured gap, not a speculative widening: of 25
+  // borderline-destructive operations probed against `commandOp`, 17 classified
+  // as NOTHING — the guard was sharp on five spellings and silent on the rest,
+  // including three that are strictly worse than the ones it caught (deleting
+  // branch protection, approving a review that releases an armed auto-merge,
+  // and unpublishing a package every lockfile already resolved).
+  //
+  // Each entry below is an operation the `non-destructive-by-default` Hard
+  // Floor already declares never-autonomous in prose. Naming them here makes an
+  // existing prohibition mechanical; it does not create a new one.
+  /** `npm unpublish` — the "undo" that breaks every lockfile resolving it. */
+  | "unpublish"
+  /** `npm deprecate` — no code changes, and every install in the world warns. */
+  | "deprecate"
+  /** Replacing or removing a published release asset consumers checksummed. */
+  | "release-asset"
+  /** Removing a branch protection rule or ruleset — deletes the guard itself. */
+  | "protection"
+  /** Disabling a workflow — no data lost, and the gate below it is gone. */
+  | "workflow-toggle"
+  /** Archiving, deleting or re-visibility-ing a repository. */
+  | "repo-lifecycle"
+  /** Approving a review — no code moves, and a required-review gate opens. */
+  | "review-approve"
+  /** Force-push — discards commits that arrived after your last fetch. */
+  | "force-push"
+  /** `git worktree remove --force` — destroys work a parallel session holds. */
+  | "worktree-remove"
+  /** `git clean -x` — takes `.env` and local certificates with the scratch. */
+  | "clean-ignored"
+  /** Moving an existing tag locally; the push that publishes it is `tag`. */
+  | "tag-force"
+  /** Rebase — local until pushed, then a history rewrite for everyone. */
+  | "rebase"
+  /** `git reset --hard` — uncommitted work does not reach the reflog. */
+  | "reset-hard"
+  /** `git clean` without `-x` — untracked only, ignored files survive. */
+  | "clean"
+  /** Dropping or clearing a stash. */
+  | "stash-drop"
+  /** Deleting a branch, locally or on the remote. */
+  | "branch-delete"
+  /** Closing a pull request or an issue. */
+  | "close";
 
 export const ALL_OPS: readonly GitOp[] = [
   "commit",
@@ -182,6 +242,23 @@ export const ALL_OPS: readonly GitOp[] = [
   "tag",
   "release",
   "publish",
+  "unpublish",
+  "deprecate",
+  "release-asset",
+  "protection",
+  "workflow-toggle",
+  "repo-lifecycle",
+  "review-approve",
+  "force-push",
+  "worktree-remove",
+  "clean-ignored",
+  "tag-force",
+  "rebase",
+  "reset-hard",
+  "clean",
+  "stash-drop",
+  "branch-delete",
+  "close",
 ];
 
 /**
@@ -195,7 +272,17 @@ export const ALL_OPS: readonly GitOp[] = [
 const PHRASES: ReadonlyArray<{ op: GitOp; re: RegExp }> = [
   { op: "commit", re: /\b(commit(e|et|te|ten)?|committe|einchecken)\b/i },
   { op: "push", re: /\b(push(e|en|t)?|hochladen|hochschieben|raufschieben)\b/i },
-  { op: "branch", re: /\b(branch|feature-branch|zweig)\b/i },
+  // A CREATION VERB IS REQUIRED, as for `pr-create` above and for the same
+  // reason. The bare noun could not tell an authorization from a mention, and
+  // the mention is the dangerous half: "den branch nicht löschen" names the
+  // object precisely in order to forbid acting on it, yet authorized branch
+  // creation — the negation trails a bare-noun match, so neither the
+  // look-behind nor the span check in `negatedBefore` can reach it. Widened
+  // 2026-09-03 alongside the destructive-coverage work that measured it.
+  {
+    op: "branch",
+    re: /\b(erstell(e|en)?|mach(e|en)?|leg(e|en)?\s+an|anleg(e|en)?|(er|be)?(ö|oe)ffne|open|create|new|neuer?|starte?|checkout|wechsl?e|switch)\b[^.\n]{0,30}\b(branch|feature-branch|zweig)\b|\b(branch|feature-branch|zweig)\b[^.\n]{0,25}\b(erstellen|anlegen|aufmachen|(ö|oe)ffnen|starten)\b/i,
+  },
   // A creation verb is required — "schau dir den PR an" is not "open a PR".
   {
     op: "pr-create",
@@ -209,20 +296,22 @@ const PHRASES: ReadonlyArray<{ op: GitOp; re: RegExp }> = [
   // "never auto-merge" each returned ["pr-merge"] — a prompt saying DO NOT
   // MERGE authorized a merge. The noun-sense lookahead was never a negator.
   //
-  // The lookBEHIND is line-scoped by `[^.!?\n]` on purpose, the same scoping
-  // `turn_end_gate_hook.ts` uses for its own negation exclusion (`:330`) and
-  // its negated-claim window (`:490-493`). A sentence boundary ends a
-  // negation's reach: "Do not push. Merge PR #12." is two instructions, and a
-  // guard that let the first suppress the second would silently stop
-  // authorizing merges the user DID order — the failure mode that is worse
-  // than the defect, because nothing happens and nothing says why.
-  //
-  // Reusing that vocabulary rather than inventing a third is deliberate: two
+  // The inline negative lookBEHIND that used to live in this pattern was
+  // REMOVED on 2026-09-03, and its own comment is why. It warned that "two
   // negation vocabularies in one tree drift, and the drift is invisible until
-  // a prompt lands in the gap between them.
+  // a prompt lands in the gap between them" — and by then they had drifted:
+  // `negatedBefore` became clause-scanned in both directions while this
+  // lookbehind stayed a blind 30-character window with no forward half. The
+  // prompt that landed in the gap is `"nicht pushen, aber mergen"`, which the
+  // lookbehind refused (13 characters, inside its window, across a contrast
+  // cue it could not see) while the clause scan correctly authorizes it.
+  //
+  // Every phrase match already passes through `negatedBefore` at the call
+  // site, so the guard is not weakened by the removal — it is applied once,
+  // by the one vocabulary this file's comment asked for.
   {
     op: "pr-merge",
-    re: /(?<!\b(nicht|nichts|kein(e|en|em|er|es)?|niemals|nie|no|not|dont|don't|never|without|ohne)\b[^.!?\n]{0,30})\b(merge|merg(e|en|st|t)|zusammenf(ü|ue)hren|reinmergen)\b(?!\s*[- ]?(conflict|konflikt|commit|base|queue|state|status))/i,
+    re: /\b(merge|merg(e|en|st|t)|zusammenf(ü|ue)hren|reinmergen)\b(?!\s*[- ]?(conflict|konflikt|commit|base|queue|state|status))/i,
   },
   // A tag is an ACTION here — bare "Tag" is the German word for day, and
   // "Version" is an ordinary noun. Both authorized a BLOCK op before this.
@@ -233,6 +322,111 @@ const PHRASES: ReadonlyArray<{ op: GitOp; re: RegExp }> = [
     re: /\b(releasen?|ver(ö|oe)ffentlich(e|en))\b(?!\s*[- ]?(notes?|branch|candidate|pr\b|datum|date|zweig))/i,
   },
   { op: "publish", re: /\b(publish(e|en)?|publiziere[n]?)\b/i },
+
+  // ── Authorization vocabulary for the ops added 2026-09-03.
+  //
+  // NON-NEGOTIABLE, and the reason it ships in the same change as the new BLOCK
+  // ops: a blocked operation with no phrase that authorizes it is a dead end.
+  // The guard refuses, the user says "doch, mach das", the classifier records
+  // nothing, and the refusal repeats forever. Every op the guard can block must
+  // have a sentence that unblocks it, or the user's override is a claim rather
+  // than a mechanism.
+  //
+  // Tight on purpose. Under-matching costs one confirmation; over-matching
+  // authorizes something the user did not ask for, so each pattern demands the
+  // object noun rather than a bare verb wherever the verb is ordinary German.
+  //
+  // `unpublish` before nothing in particular — `\bpublish\b` does not match
+  // inside "unpublish" (no word boundary between `n` and `p`), so the two never
+  // collide.
+  // TWO SHAPES EVERY GERMAN PATTERN BELOW MUST CARRY, both learned from tests
+  // that went red rather than from inspection:
+  //
+  //   1. THE IMPERATIVE DROPS ITS `-e`. "entfern die worktree", "archivier das
+  //      repo", "deaktivier den workflow" are what people type; `entfern(e|en)`
+  //      matches none of them. Every verb ending is therefore `(e|en)?`.
+  //   2. WORD ORDER GOES BOTH WAYS. "archivier das repo" and "das repo
+  //      archivieren" are one instruction, and a pattern anchored on the noun
+  //      first sees only the second.
+  //
+  // The object noun stays REQUIRED in every pattern that has one. That is what
+  // keeps the loosened verb endings from over-authorizing: "lösch" alone
+  // authorizes nothing, "lösch den branch" authorizes a branch deletion.
+  { op: "unpublish", re: /\bunpublish(e|en)?\b/i },
+  {
+    op: "deprecate",
+    re: /\bdeprecate(d|n)?\b|\bals\s+veraltet\s+markier(e|en)?\b/i,
+  },
+  {
+    op: "release-asset",
+    re: /\brelease[-\s]?asset\b|\b(clobber|(ü|ue)berschreib(e|en)?|ersetz(e|en)?|replace|austausch(e|en)?)\b[^.\n]{0,25}\b(asset|artefakt|artifact|tarball|binary)\b|\b(asset|artefakt|artifact)\b[^.\n]{0,25}\b((ü|ue)berschreiben|ersetzen|austauschen|replace)\b/i,
+  },
+  // A VERB IS REQUIRED, like `tag` and `release` above and for the same reason.
+  // A bare noun cannot tell an authorization from a mention, and here the
+  // mention is the dangerous half: "die branch-protection nicht anfassen" names
+  // the object precisely in order to forbid touching it. Measured — this was the
+  // one row of the negation corpus that neither the look-behind nor the
+  // span check could reach, because the negation trails a bare-noun match.
+  {
+    op: "protection",
+    re: /\b(entfern(e|en)?|l(ö|oe)sch(e|en)?|deaktivier(e|en)?|nimm|weg|remove|delete|disable|drop|lift)\b[^.\n]{0,30}\b(branch[-\s]?protection|protection[-\s]?rule|schutzregel|ruleset)\b|\b(branch[-\s]?protection|protection[-\s]?rule|schutzregel|ruleset)\b[^.\n]{0,30}\b(entfernen|l(ö|oe)schen|deaktivieren|abschalten|remove|delete|disable|drop|lift|weg)\b/i,
+  },
+  {
+    op: "workflow-toggle",
+    re: /\bworkflow\b[^.\n]{0,25}\b(deaktivier(e|en)?|aktivier(e|en)?|disable|enable|abschalt(e|en)?|ausschalt(e|en)?)\b|\b(deaktivier(e|en)?|aktivier(e|en)?|disable|enable|abschalt(e|en)?|ausschalt(e|en)?)\b[^.\n]{0,25}\bworkflow\b/i,
+  },
+  {
+    op: "repo-lifecycle",
+    re: /\b(repo|repository)\b[^.\n]{0,30}\b(archivier(e|en)?|archive|l(ö|oe)sch(e|en)?|delete)\b|\b(archivier(e|en)?|archive|l(ö|oe)sch(e|en)?|delete)\b[^.\n]{0,25}\b(repo|repository)\b|\b(repo|repository)\b[^.\n]{0,30}\bauf\s+(privat|public|öffentlich|private)\b/i,
+  },
+  {
+    op: "review-approve",
+    re: /\b(approve|genehmig(e|en)?|freigeb(e|en)?|abnehm(e|en)?)\b[^.\n]{0,30}\b(review|pr|pull[-\s]request)\b|\b(review|pr|pull[-\s]request)\b[^.\n]{0,20}\b(approve|approven|genehmigen|freigeben)\b/i,
+  },
+  {
+    op: "force-push",
+    re: /\bforce[-\s]?push(e|en|st)?\b|--force(-with-lease)?\b|\bmit\s+gewalt\s+push(e|en)?\b/i,
+  },
+  {
+    op: "worktree-remove",
+    re: /\bworktree\b[^.\n]{0,25}\b(entfern(e|en)?|l(ö|oe)sch(e|en)?|remove|delete|weg(werfen|r(ä|ae)umen))\b|\b(entfern(e|en)?|l(ö|oe)sch(e|en)?|remove|delete)\b[^.\n]{0,25}\bworktree\b/i,
+  },
+  // The `-x` flag is the whole distinction: without it `git clean` spares
+  // ignored files, with it `.env` and local certificates go too.
+  {
+    op: "clean-ignored",
+    re: /\bgit\s+clean\b[^.\n]{0,20}-[A-Za-z]*x|\b(ignorierte|ignored)\b[^.\n]{0,25}\b(dateien|files)\b[^.\n]{0,25}\b(l(ö|oe)sch(e|en)?|entfern(e|en)?|remove|delete)\b/i,
+  },
+  {
+    op: "tag-force",
+    re: /\btag\b[^.\n]{0,25}\b(verschieb(e|en)?|(ü|ue)berschreib(e|en)?|umh(ä|ae)ng(e|en)?|force|move)\b|\b(verschieb(e|en)?|(ü|ue)berschreib(e|en)?)\b[^.\n]{0,20}\btag\b/i,
+  },
+  { op: "rebase", re: /\brebase(n|st|d)?\b/i },
+  {
+    op: "reset-hard",
+    re: /\breset\s+--hard\b|\bhard\s+reset\b|\bhart\s+zur(ü|ue)cksetz(e|en)?\b/i,
+  },
+  { op: "clean", re: /\bgit\s+clean\b/i },
+  {
+    op: "stash-drop",
+    re: /\bstash\b[^.\n]{0,25}\b(drop|clear|verwerf(e|en)?|l(ö|oe)sch(e|en)?)\b|\b(verwerf(e|en)?|l(ö|oe)sch(e|en)?|drop)\b[^.\n]{0,20}\bstash\b/i,
+  },
+  {
+    op: "branch-delete",
+    re: /\b(l(ö|oe)sch(e|en)?|entfern(e|en)?|delete|remove)\b[^.\n]{0,25}\b(branch|branches|zweig)\b|\b(branch|branches|zweig)\b[^.\n]{0,25}\b(l(ö|oe)schen|entfernen|delete|remove)\b/i,
+  },
+  {
+    op: "close",
+    re: /\b(schlie(ß|ss)(e|en)?|close)\b[^.\n]{0,30}\b(pr|pull[-\s]request|issue|ticket)\b|\b(pr|pull[-\s]request|issue|ticket)\b[^.\n]{0,20}\b(schlie(ß|ss)en|close)\b/i,
+  },
+  // Enabling auto-merge is its own op on the guard side, so it needs its own
+  // sentence. Without one it is the dead end this block exists to prevent: the
+  // plain merge phrase authorizes `pr-merge` and never `pr-merge-auto`, so the
+  // refusal would have repeated forever.
+  {
+    op: "pr-merge-auto",
+    re: /\bauto[-\s]?merge\b|\bmerge\b[^.\n]{0,20}\bautomatisch\b|\bautomatisch\b[^.\n]{0,20}\bmerg(e|en)\b/i,
+  },
 ];
 
 /**
@@ -258,15 +452,26 @@ export function isInterrogative(prose: string): boolean {
   if (!t) {
     return false;
   }
+  // An explicit trailing question mark OUTRANKS the imperative escape below.
+  // Measured 2026-09-03: the escape ran first, so "Can you do the release
+  // now?" needed `now` to stay OUT of the imperative list to be read as a
+  // question — which left `now` absent while its German counterpart `jetzt`
+  // was present, and "Do the release now." was therefore classified a question
+  // and authorized nothing while "Do the release jetzt." authorized `release`.
+  // Ordering the `?` first is what makes closing that parity gap safe: it is a
+  // NARROWING (more prompts read as questions), and it lets the widening below
+  // be a one-word list addition rather than a trade.
+  if (/\?\s*$/.test(t)) {
+    return true;
+  }
   const hasImperative =
-    /\b(mach|mache|bitte|leg|lege|erstell|erstelle|f(ü|ue)hr|f(ü|ue)hre|setz|setze|starte|los|jetzt|go ahead|do it|ja[,.]?\s|ok[,.]?\s)\b/i.test(
+    /\b(mach|mache|bitte|leg|lege|erstell|erstelle|f(ü|ue)hr|f(ü|ue)hre|setz|setze|starte|los|jetzt|now|asap|go ahead|do it|ja[,.]?\s|ok[,.]?\s)\b/i.test(
       t,
     );
   if (hasImperative) {
     return false;
   }
   return (
-    /\?\s*$/.test(t) ||
     /^(was|wie|warum|wieso|weshalb|wann|wer|welche[rs]?|wo|ist|sind|kann|kannst|k(ö|oe)nnen|soll|sollen|darf|d(ü|ue)rfen|why|what|how|when|which|who|is|are|can|could|should|does|do)\b/i.test(
       t,
     )
@@ -358,12 +563,367 @@ function _commandLines(fence: string): string[] {
     .filter((l) => /^(git|gh|npm|pnpm|yarn|task)\b/.test(l));
 }
 
+/**
+ * A standing, target-bound, single-use capability minted from the user's own
+ * words — the ADR-252 shape.
+ *
+ * A `GitOp` in `authorized` says *the user named this operation on this turn*
+ * and is governed by the guard's freshness clock. A grant says something
+ * strictly narrower: *the user named this operation AND the exact objects it
+ * may act on*. Because the objects are frozen at grant time, elapsed time stops
+ * being the thing that protects the user — target identity is — so a grant
+ * carries no clock.
+ *
+ * The narrowing is what buys the clock exemption, and it is why only
+ * enumerable operations can hold one. `npm publish` names a version, not the
+ * bytes that will be published, so no prompt can freeze its effect; it holds no
+ * grants and keeps the clock. See ADR-252 § Per-operation verdict.
+ */
+export type MergeGrant = {
+  /** Replay-resistant id — session slug, mint time, and the frozen target set. */
+  id: string;
+  /** Only `pr-merge` mints grants today. The field exists so the reader of a
+   *  stored ledger never has to infer the op from the grant's shape. */
+  op: GitOp;
+  /** PR numbers named by the human, frozen at mint time. Never a wildcard: a
+   *  cardinality word with no numbers mints nothing (ADR-252 § What "all" does
+   *  not buy). */
+  targets: number[];
+  /** Per-target single-use state. A merged target is spent and cannot be
+   *  replayed, which is what makes a force-push back to a merged SHA harmless. */
+  consumed: number[];
+  granted_at: string;
+  /** The literal human phrase, for audit. Never the enforcement key. */
+  evidence: string;
+};
+
 export interface Ledger extends JsonObject {
   session_id: string;
   detected_at: string;
   authorized: GitOp[];
   evidence: { [op: string]: string };
   prompt_chars: number;
+  /**
+   * Standing grants, carried across the session's human turns.
+   *
+   * Optional so a ledger written by an older build still parses. Absent reads
+   * as "no grants", which is the pre-ADR-252 behaviour exactly.
+   */
+  grants?: MergeGrant[];
+}
+
+/**
+ * PR numbers the prompt names, as merge targets.
+ *
+ * Deliberately narrow. It matches a `#`-prefixed or `PR `-prefixed integer and
+ * nothing else, so a bare number in prose ("merge the 3 branches") freezes no
+ * target and mints no grant. Over-matching here would hand a clockless
+ * capability to a sentence that never identified an object, which is the exact
+ * conflation of lexical and object specificity both council seats rejected.
+ */
+/** One-line, bounded rendering of a caught value for a diagnostic. */
+function _errText(err: unknown): string {
+  const t = err instanceof Error ? err.message : String(err);
+  return t.replace(/\s+/g, " ").trim().slice(0, 200);
+}
+
+/**
+ * The largest pull-request number GitHub can issue: a signed 32-bit integer.
+ *
+ * Taken from the API contract rather than estimated, and shared by the mint
+ * site here and the consume site in `hooks/block_unauthorized_git.ts` so the
+ * two cannot drift — the failure this file already learned once with its
+ * negation vocabulary.
+ */
+export const PR_NUMBER_MAX = 2147483647;
+
+export function extractMergeTargets(prompt: string): number[] {
+  const out = new Set<number>();
+  // The BOUND comes from the API contract, not from a guess: GitHub issue and
+  // pull-request numbers are a signed 32-bit integer, so ten digits is the
+  // lexical ceiling and `PR_NUMBER_MAX` is the real one. The old `\d{1,7}` was
+  // neither — an eight-digit number simply failed to match, and since the
+  // `\b` sits after digit seven it failed SILENTLY rather than out of range.
+  //
+  // Widening here is required for the consume-side widening to do anything at
+  // all: this is where a grant's target set is frozen, so a target that cannot
+  // be MINTED can never be matched however well it resolves later.
+  //
+  // The `#` / `PR ` prefix requirement is deliberately unchanged. Over-matching
+  // here would hand a clockless capability to a sentence that never identified
+  // an object, which is the conflation of lexical and object specificity both
+  // council seats rejected.
+  const re = /(?:#|\bpr[- ]?|\bpull[- ]request\s+#?)(\d{1,10})\b/giu;
+  let m: RegExpExecArray | null;
+  while ((m = re.exec(prompt)) !== null) {
+    const n = Number.parseInt(m[1] as string, 10);
+    if (Number.isSafeInteger(n) && n > 0 && n <= PR_NUMBER_MAX) {
+      out.add(n);
+    }
+  }
+  return [...out].sort((a, b) => a - b);
+}
+
+/**
+ * A human turn that withdraws standing merge authority.
+ *
+ * Revocation must be cheaper to express than authorization, so this matches a
+ * bare stop word on its own as well as an explicit "don't merge". It is
+ * deliberately over-inclusive in the safe direction: a false revocation costs
+ * one prompt, a missed revocation costs an unwanted merge.
+ */
+const REVOKE_RE =
+  /\b(stop|stopp|halt|abbrechen|abbruch|cancel|revoke|widerruf(en)?|zur(ü|ue)ck(nehmen|ziehen)|hold\s+(everything|on|the\s+merge)|warte|wait)\b|(?:\b(nicht|kein(e|en)?|no|not|dont|don't|never|niemals|nie)\b[^.!?\n]{0,30}\b(merg(e|en|ing)|zusammenf(ü|ue)hren)\b)/iu;
+
+/** Does this human turn withdraw standing merge grants? */
+export function isRevocation(prompt: string): boolean {
+  return REVOKE_RE.test(prompt);
+}
+
+/** Mint a grant id that a replayed ledger cannot collide with. */
+function _grantId(session_id: string, at: string, targets: number[]): string {
+  return `${sessionSlug(session_id) || "nosession"}:${at}:${targets.join(",")}`;
+}
+
+/**
+ * Fold this turn's authorization into the grants the session already holds.
+ *
+ * Three rules, and the order is the contract:
+ *   1. A revocation drops every standing grant. It wins over anything else in
+ *      the same prompt — "merge #1 but stop if it conflicts" revokes.
+ *   2. An explicit `pr-merge` naming PR numbers mints one grant over those
+ *      numbers.
+ *   3. Everything else carries the existing grants forward untouched. This is
+ *      the clause that fixes the measured defect: before ADR-252 a neutral
+ *      "weiter" replaced the whole ledger and silently erased authority the
+ *      user had given two turns earlier.
+ *
+ * Consumption is NOT done here — the guard consumes a target when it actually
+ * lets the merge through, so a grant that was never acted on stays whole.
+ */
+export function foldGrants(
+  prior: MergeGrant[],
+  prompt: string,
+  authorized: GitOp[],
+  session_id: string,
+  now: Date,
+): MergeGrant[] {
+  if (isRevocation(prompt)) {
+    return [];
+  }
+  const carried = prior.filter((g) => g.consumed.length < g.targets.length);
+  if (!authorized.includes("pr-merge")) {
+    return carried;
+  }
+  const targets = extractMergeTargets(prompt);
+  if (targets.length === 0) {
+    return carried;
+  }
+  const at = now.toISOString();
+  const already = new Set(carried.flatMap((g) => g.targets));
+  const fresh = targets.filter((t) => !already.has(t));
+  if (fresh.length === 0) {
+    return carried;
+  }
+  return [
+    ...carried,
+    {
+      id: _grantId(session_id, at, fresh),
+      op: "pr-merge",
+      targets: fresh,
+      consumed: [],
+      granted_at: at,
+      evidence: prompt.trim().slice(0, 120),
+    },
+  ];
+}
+
+/**
+ * Negation words that turn an instruction into its opposite.
+ *
+ * ONE vocabulary for the whole file, deliberately. The `pr-merge` pattern
+ * already carried this list inline, and its own comment warns that "two
+ * negation vocabularies in one tree drift, and the drift is invisible until a
+ * prompt lands in the gap between them" — so the list moved here rather than
+ * being copied fifteen times.
+ */
+const NEGATION_WORD =
+  /\b(nicht|nichts|kein(e|en|em|er|es)?|niemals|nie|no|not|dont|don't|never|without|ohne)\b/i;
+
+/**
+ * Is the match at `index` under a negation?
+ *
+ * MEASURED, not anticipated. Probed on 2026-09-03 against the fifteen phrases
+ * added that day: **15 of 15 leaked** — "nicht unpublishen", "den workflow nicht
+ * deaktivieren", "kein force-push bitte" each authorized exactly the operation
+ * the sentence forbade. The same probe showed the hole predates them, since
+ * "kein force-push bitte" also authorized a plain `push` and "den branch nicht
+ * löschen" also authorized `branch`. Only `pr-merge` was protected, by a
+ * lookbehind written after the identical defect was found there in isolation.
+ *
+ * SENTENCE-SCOPED, and that bound is load-bearing rather than decorative.
+ * "Do not push. Merge PR #12." is two instructions, and a negation whose reach
+ * crossed the full stop would silently stop authorizing merges the user DID
+ * order — a failure worse than the defect, because nothing happens and nothing
+ * says why. The 30-character window inside the sentence is inherited from the
+ * `pr-merge` lookbehind that this generalises.
+ */
+const CONTRAST_CUE = /\b(aber|sondern|jedoch|but|however|instead)\b/gi;
+
+/**
+ * Abbreviation and decimal dots are NOT sentence boundaries.
+ *
+ * MEASURED. `"Du sollst nicht z.B. den PR #12 mergen."` authorized `pr-merge`
+ * at 022c0d240: the boundary scan took the second dot of `z.B.` as the sentence
+ * start, which put the window at `" den PR #12 "` and left `nicht` out of
+ * scope. `"Nach Release 1.5 bitte nicht mergen."` fails the same way on the
+ * decimal point.
+ *
+ * Two rules, both narrow on purpose. A dot is not a boundary when it sits
+ * between digits, or when the word-ish token ending at it is a known
+ * abbreviation — including a single letter, which is what makes `z.B.` two
+ * non-boundaries rather than one.
+ */
+const ABBREVIATION_BEFORE_DOT =
+  /(?:^|[\s("'\u2018\u201c])(?:[a-z]|z\.b|bzw|ca|usw|d\.h|u\.a|evtl|ggf|inkl|max|min|nr|abb|e\.g|i\.e|etc|vs|approx|fig|no|st|dr|prof)\.$/i;
+
+function isSentenceBoundary(text: string, at: number): boolean {
+  const mark = text[at];
+  if (mark !== ".") {
+    return true;
+  }
+  if (/\d/.test(text[at - 1] ?? "") && /\d/.test(text[at + 1] ?? "")) {
+    return false;
+  }
+  return !ABBREVIATION_BEFORE_DOT.test(text.slice(0, at + 1));
+}
+
+/** Bounds of the sentence containing `index`, abbreviation- and decimal-aware. */
+export function sentenceBounds(text: string, index: number): { start: number; end: number } {
+  let start = 0;
+  for (let i = index - 1; i >= 0; i -= 1) {
+    const c = text[i] as string;
+    if ((c === "." || c === "!" || c === "?" || c === "\n") && isSentenceBoundary(text, i)) {
+      start = i + 1;
+      break;
+    }
+  }
+  let end = text.length;
+  for (let i = index; i < text.length; i += 1) {
+    const c = text[i] as string;
+    if ((c === "." || c === "!" || c === "?" || c === "\n") && isSentenceBoundary(text, i)) {
+      end = i;
+      break;
+    }
+  }
+  return { start, end };
+}
+
+/**
+ * Split prose into sentences on the same boundaries `sentenceBounds` uses, so
+ * an abbreviation or a decimal point cannot split one instruction into two.
+ */
+export function _sentences(text: string): string[] {
+  const out: string[] = [];
+  let from = 0;
+  for (let i = 0; i < text.length; i += 1) {
+    const c = text[i] as string;
+    if ((c === "." || c === "!" || c === "?" || c === "\n") && isSentenceBoundary(text, i)) {
+      out.push(text.slice(from, i + 1));
+      from = i + 1;
+    }
+  }
+  if (from < text.length) {
+    out.push(text.slice(from));
+  }
+  return out.filter((t) => t.trim() !== "");
+}
+
+/** Last clause boundary at or before `to`, within `[from, to)`. */
+function clauseStart(text: string, from: number, to: number): number {
+  let start = from;
+  const seg = text.slice(from, to);
+  for (let i = seg.length - 1; i >= 0; i -= 1) {
+    const c = seg[i] as string;
+    if (c === "," || c === ";" || c === ":") {
+      start = from + i + 1;
+      break;
+    }
+  }
+  CONTRAST_CUE.lastIndex = 0;
+  let m: RegExpExecArray | null;
+  while ((m = CONTRAST_CUE.exec(seg)) !== null) {
+    const after = from + m.index + m[0].length;
+    if (after > start) {
+      start = after;
+    }
+  }
+  return start;
+}
+
+/** First clause boundary at or after `from`, within `(from, to]`. */
+function clauseEnd(text: string, from: number, to: number): number {
+  const seg = text.slice(from, to);
+  let end = to;
+  const punct = seg.search(/[,;:]/);
+  if (punct !== -1) {
+    end = from + punct;
+  }
+  CONTRAST_CUE.lastIndex = 0;
+  const m = CONTRAST_CUE.exec(seg);
+  if (m !== null && from + m.index < end) {
+    end = from + m.index;
+  }
+  return end;
+}
+
+/**
+ * Is the match at `index` under a negation?
+ *
+ * MEASURED, not anticipated. Probed on 2026-09-03 against the fifteen phrases
+ * added that day: **15 of 15 leaked** — "nicht unpublishen", "den workflow nicht
+ * deaktivieren", "kein force-push bitte" each authorized exactly the operation
+ * the sentence forbade. The same probe showed the hole predates them, since
+ * "kein force-push bitte" also authorized a plain `push` and "den branch nicht
+ * löschen" also authorized `branch`. Only `pr-merge` was protected, by a
+ * lookbehind written after the identical defect was found there in isolation.
+ *
+ * SENTENCE-SCOPED, and that bound is load-bearing rather than decorative.
+ * "Do not push. Merge PR #12." is two instructions, and a negation whose reach
+ * crossed the full stop would silently stop authorizing merges the user DID
+ * order — a failure worse than the defect, because nothing happens and nothing
+ * says why.
+ *
+ * CLAUSE-SCANNED IN BOTH DIRECTIONS since 2026-09-03, replacing a fixed
+ * 30-character lookbehind inherited from the `pr-merge` pattern. Four shapes
+ * leaked past that window, all measured at 022c0d240:
+ *
+ *   "Merge PR #12 auf keinen Fall."          negation AFTER the match
+ *   "Merge #12 under no circumstances."      negation AFTER the match
+ *   "Du sollss nicht z.B. den PR #12 mergen." abbreviation dot cut the sentence
+ *   "Bitte unter keinen Umstaenden … mergen"  38-44 chars, past the 30 window
+ *
+ * The scan runs to the nearest CLAUSE boundary rather than to the sentence
+ * bound, and that half is what keeps the widening from over-denying: a comma,
+ * a semicolon, a colon or a contrast cue ends the scan. Without it,
+ * "I do not want to wait any longer, please merge PR #12" would read as
+ * negated and silently refuse a merge the user ordered — the failure the
+ * sentence bound above exists to prevent, reintroduced one level down. With
+ * it, "Merge PR #123, but do not push to production." keeps authorizing the
+ * merge and keeps denying the push, which is the only reading a human gives it.
+ */
+export function negatedBefore(text: string, index: number, matched = ""): boolean {
+  const { start, end } = sentenceBounds(text, index);
+  const before = text.slice(clauseStart(text, start, index), index);
+  const afterFrom = index + matched.length;
+  const after =
+    afterFrom < end ? text.slice(afterFrom, clauseEnd(text, afterFrom, end)) : "";
+  // The negation is often INSIDE the match, not before it, and German word
+  // order is why: "das asset nicht ersetzen" is matched by a noun-first pattern
+  // that starts at "asset", so a look-behind from the match index sees an empty
+  // window. Measured — nine of the fifteen rows in the negation corpus failed
+  // exactly this way after the look-behind alone was added.
+  return NEGATION_WORD.test(before) || NEGATION_WORD.test(matched) || NEGATION_WORD.test(after);
 }
 
 /** Classify which ops a prompt authorizes. Exported for direct testing. */
@@ -382,11 +942,30 @@ export function classifyAuthorization(prompt: string): {
     .filter((l) => !OUTPUT_LINE.test(l))
     .join("\n");
 
-  for (const { op, re } of isInterrogative(instruction) ? [] : PHRASES) {
-    const m = re.exec(instruction);
-    if (m) {
-      authorized.add(op);
-      evidence[op] = `prose: "${m[0]}"`;
+  // PER SENTENCE, not per prompt. `isInterrogative` reads a leading "Do " as a
+  // question, so `"Do not push. Merge PR #12."` classified the WHOLE block as
+  // interrogative and authorized nothing — a merge the user ordered in the
+  // second sentence, silently dropped because of the first word of the first.
+  // Measured at 022c0d240, and the archived roadmap that added the check had
+  // already recorded it as pre-existing. `"Do the release now. Merge PR #12."`
+  // and `"Is everything green. Merge PR #12."` fail the same way.
+  //
+  // The bound this restores is the one `question-not-instruction` states: a
+  // question sentence authorizes nothing, and an instruction sentence beside
+  // it still does. A genuine question is still refused whole —
+  // `"was macht npm publish eigentlich genau?"` is one sentence and stays
+  // denied.
+  for (const { op, re } of PHRASES) {
+    for (const sentence of _sentences(instruction)) {
+      if (isInterrogative(sentence)) {
+        continue;
+      }
+      const m = re.exec(sentence);
+      if (m && !negatedBefore(sentence, m.index, m[0])) {
+        authorized.add(op);
+        evidence[op] = `prose: "${m[0]}"`;
+        break;
+      }
     }
   }
 
@@ -418,6 +997,98 @@ export function classifyAuthorization(prompt: string): {
   return { authorized: [...authorized], evidence };
 }
 
+/** Grants the session already holds, or `[]` for any ledger that has none. */
+export function readGrants(consumer_root: string, session_id: string): MergeGrant[] {
+  try {
+    const raw = fs.readFileSync(path.join(consumer_root, ledgerFileFor(session_id)), "utf8");
+    const decoded = JSON.parse(raw) as unknown;
+    if (!_isObject(decoded) || !Array.isArray(decoded["grants"])) {
+      return [];
+    }
+    // A grant recorded against a different session is another conversation's
+    // consent, exactly as the ledger's own session check treats `authorized`.
+    const owner = typeof decoded["session_id"] === "string" ? decoded["session_id"] : "";
+    if (session_id && owner && owner !== session_id) {
+      return [];
+    }
+    return (decoded["grants"] as unknown[]).flatMap((g) => {
+      if (!_isObject(g)) return [];
+      const op = g["op"];
+      if (typeof op !== "string" || !(ALL_OPS as readonly string[]).includes(op)) return [];
+      const targets = Array.isArray(g["targets"]) ? g["targets"] : [];
+      const consumed = Array.isArray(g["consumed"]) ? g["consumed"] : [];
+      return [
+        {
+          id: String(g["id"] ?? ""),
+          op: op as GitOp,
+          targets: targets.filter((t): t is number => typeof t === "number"),
+          consumed: consumed.filter((t): t is number => typeof t === "number"),
+          granted_at: String(g["granted_at"] ?? ""),
+          evidence: String(g["evidence"] ?? ""),
+        },
+      ];
+    });
+  } catch {
+    return [];
+  }
+}
+
+/**
+ * Mark one target spent, in place, on the session's ledger.
+ *
+ * Called by the guard at the moment it lets a merge through — not by the agent,
+ * and not at mint time. A grant the run never reached stays whole, and a target
+ * that merged can never be replayed, which is what makes a force-push back to
+ * an already-merged SHA harmless.
+ */
+export function consumeGrantTarget(
+  consumer_root: string,
+  session_id: string,
+  target: number,
+): void {
+  const file = path.join(consumer_root, ledgerFileFor(session_id));
+  let decoded: unknown;
+  try {
+    decoded = JSON.parse(fs.readFileSync(file, "utf8"));
+  } catch {
+    return;
+  }
+  if (!_isObject(decoded) || !Array.isArray(decoded["grants"])) {
+    return;
+  }
+  let touched = false;
+  for (const g of decoded["grants"] as unknown[]) {
+    if (!_isObject(g) || !Array.isArray(g["targets"]) || !Array.isArray(g["consumed"])) {
+      continue;
+    }
+    const targets = g["targets"] as JsonValue[];
+    const consumed = g["consumed"] as JsonValue[];
+    if (targets.includes(target) && !consumed.includes(target)) {
+      consumed.push(target);
+      touched = true;
+    }
+  }
+  if (touched) {
+    try {
+      atomic_write_json(file, decoded as JsonObject);
+    } catch (err) {
+      /* The FAILURE DIRECTION is unchanged and still defensible: a failed write
+         leaves the target unspent, which re-allows one merge of a PR the user
+         did authorize by name — it fails toward the user's stated intent, never
+         toward an unauthorized target. What changed on 2026-09-03 is that it is
+         no longer INVISIBLE. "Observability only" was the reason given for
+         writing nothing, which inverted the word: a grant that silently fails
+         to be consumed is a capability that outlives its single use, and the
+         operator has no way to know. */
+      process.stderr.write(
+        `git-authorization: grant-consumption write failed (${_errText(err)}) — ` +
+          "the target stays UNSPENT, so one further merge of a PR the user named " +
+          "will still be authorized. Authorization outcome unchanged.\n",
+      );
+    }
+  }
+}
+
 /**
  * Read the refused operation, and consume it in the same breath.
  *
@@ -525,20 +1196,41 @@ export function run(stdin_text: string, options: { consumer_root: string }): num
       `"${prompt.trim().slice(0, 40)}"`;
   }
 
+  const now = new Date();
   const ledger: Ledger = {
     session_id: typeof envelope["session_id"] === "string" ? envelope["session_id"] : "",
-    detected_at: new Date().toISOString(),
+    detected_at: now.toISOString(),
     authorized,
     evidence,
     prompt_chars: prompt.length,
+    // Grants survive this write; `authorized` does not. That asymmetry IS the
+    // decision. A bare operation name stays one-shot exactly as `commit-policy`
+    // requires, and only an authorization that also froze its objects earns a
+    // life longer than the turn. See ADR-252.
+    grants: foldGrants(
+      readGrants(options.consumer_root, session),
+      prompt,
+      authorized,
+      session,
+      now,
+    ),
   };
 
   try {
     atomic_write_json(path.join(options.consumer_root, ledgerFileFor(session)), ledger);
-  } catch {
-    // Observability only — a failed write degrades the gate to "no ledger",
-    // which the pre_tool_use concern treats as "not authorized" for the
-    // irreversible subset and as a warn for the rest.
+  } catch (err) {
+    // The SIBLING of the swallow in `consumeGrantTarget`, and named here
+    // because AC-5 describes a behavioural class rather than one call site:
+    // fixing one and leaving the other would have made the acceptance claim
+    // half true. Same reasoning, different degradation — a failed write here
+    // degrades the gate to "no ledger", which the pre_tool_use concern treats
+    // as "not authorized" for the irreversible subset and as a warn for the
+    // rest, so the direction is fail-closed and still unchanged.
+    process.stderr.write(
+      `git-authorization: session-ledger write failed (${_errText(err)}) — ` +
+        "the gate degrades to \"no ledger\" for this session, which denies the " +
+        "irreversible subset and warns on the rest. Authorization outcome unchanged.\n",
+    );
   }
   return EXIT_ALLOW;
 }