@event4u/agent-config 9.12.0 → 9.14.0

package/src/scripts/check_dependency_floors.ts

@@ -44,11 +44,14 @@ const REPO_ROOT = path.resolve(fileURLToPath(import.meta.url), '..', '..', '..')
  * exact pin cannot suffer the freshest-patch failure (the version is either
  * cached or it is not), but it also forfeits patch fixes — so each one is
  * named here rather than silently tolerated.
+ *
+ * Empty since the code-graph parser pair (`web-tree-sitter` /
+ * `tree-sitter-wasms`) left `dependencies` — it was the only entry. The pair's
+ * ABI pin now lives in `code_graph/loader.ts`'s install hint, because that is
+ * the only place a re-enabler reads it; this gate scans `dependencies` and so
+ * no longer sees the pair at all.
  */
-export const EXACT_PIN_EXCEPTIONS: Readonly<Record<string, string>> = {
-    'web-tree-sitter': 'ABI-locked against tree-sitter-wasms; see code-graph engine pin',
-    'tree-sitter-wasms': 'ABI-locked against web-tree-sitter; see code-graph engine pin',
-};
+export const EXACT_PIN_EXCEPTIONS: Readonly<Record<string, string>> = {};
 
 /**
  * Floors that are non-settled ON PURPOSE, because every version below them is
@@ -74,8 +77,15 @@ const EXACT_VERSION = /^\d+\.\d+\.\d+$/;
 /**
  * Every violation in `dependencies`, as human-readable lines. Empty array
  * means the manifest cannot produce a freshest-patch `ETARGET` for a consumer.
+ *
+ * `exactPinExceptions` defaults to the module's list and is injectable so the
+ * allow-an-exact-pin branch stays covered now that the real list is empty —
+ * otherwise the only way to test it would be to add a fake production entry.
  */
-export function evaluate(dependencies: Readonly<Record<string, string>>): string[] {
+export function evaluate(
+    dependencies: Readonly<Record<string, string>>,
+    exactPinExceptions: Readonly<Record<string, string>> = EXACT_PIN_EXCEPTIONS,
+): string[] {
     const errors: string[] = [];
     for (const [name, range] of Object.entries(dependencies)) {
         const security = SECURITY_FLOOR_EXCEPTIONS[name];
@@ -89,7 +99,7 @@ export function evaluate(dependencies: Readonly<Record<string, string>>): string
             continue;
         }
         if (EXACT_VERSION.test(range)) {
-            if (!(name in EXACT_PIN_EXCEPTIONS)) {
+            if (!(name in exactPinExceptions)) {
                 errors.push(
                     `${name}@${range}: exact pin without an entry in EXACT_PIN_EXCEPTIONS — ` +
                         'add the reason there, or use a settled caret floor (^X.Y.0)',

package/src/scripts/check_gate_coverage.ts

@@ -31,13 +31,13 @@
  * Exit codes: 0 all enforced gates cleared their floor · 1 a gate is blind,
  * collapsed, or silent · 2 the manifest itself is missing/empty/malformed.
  */
-import { spawnSync } from 'node:child_process';
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import process from 'node:process';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 
 import yaml from 'js-yaml';
+import { runCountedProbe } from './_lib/counted_probe.js';
 
 const _HERE = fileURLToPath(import.meta.url);
 const REPO_ROOT = path.resolve(path.dirname(_HERE), '..', '..');
@@ -184,11 +184,11 @@ export function classify(
 
 function run_gate(spec: GateSpec): { scanned: number | null; crashed: boolean; exit_code: number | null } {
   const runner = path.join(REPO_ROOT, 'scripts-run');
-  const r = spawnSync(runner, [`src/scripts/${spec.id}`, ...spec.argv], {
-    cwd: REPO_ROOT,
-    encoding: 'utf8',
-  });
-  if (r.error !== undefined || r.status === null) return { scanned: null, crashed: true, exit_code: null };
+  // Bounded read: a gate whose output overflowed would lose its `scanned:`
+  // line and be classified `silent` — the scan-scope guard reporting a dead
+  // scope that is merely truncated. `runCountedProbe` throws instead.
+  const r = runCountedProbe(runner, [`src/scripts/${spec.id}`, ...spec.argv], { cwd: REPO_ROOT });
+  if (r.failure !== null && r.status === null) return { scanned: null, crashed: true, exit_code: null };
   // A gate may legitimately exit non-zero (it found real violations) and still
   // have scanned plenty — coverage and verdict are different questions.
   return { scanned: parse_scanned(`${r.stdout}\n${r.stderr}`), crashed: false, exit_code: r.status };

package/src/scripts/check_kernel_rule_bundle.ts

@@ -36,6 +36,7 @@ import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import { KERNEL_RULE_FILENAMES } from './_lib/kernel_rules.js';
+import { runCountedProbe } from './_lib/counted_probe.js';
 
 const KERNEL_RULES: ReadonlySet<string> = KERNEL_RULE_FILENAMES;
 
@@ -56,13 +57,13 @@ const KERNEL_DIR = 'src/rules';
 const DEFAULT_LABEL = 'bundled-always-rules-acknowledged';
 
 function _git_changed_files(base_ref: string): string[] {
-    const res = spawnSync('git', ['diff', '--name-only', `${base_ref}...HEAD`], {
-        encoding: 'utf8',
-    });
+    // Bounded read: a truncated diff would shrink the change set and let the
+    // bundle guard pass on files it never saw.
+    const res = runCountedProbe('git', ['diff', '--name-only', `${base_ref}...HEAD`]);
     // Python uses check_output(stderr=STDOUT, text=True): on non-zero it raises
     // CalledProcessError and the handler prints the combined output. spawnSync
     // does not raise; mirror by checking status and combining stdout+stderr.
-    if (res.status !== 0) {
+    if (!res.ok) {
         const combined = `${res.stdout ?? ''}${res.stderr ?? ''}`;
         process.stderr.write(`❌  git diff failed: ${combined.trim()}\n`);
         return [];

package/src/scripts/check_token_quality_golden.ts

@@ -113,20 +113,6 @@ export function router_triggers(router: Json): Map<string, Array<Record<string,
   return map;
 }
 
-// trigger_coverage.ts word semantics: lowercase alpha-led tokens, len > 2.
-const _WORD = /[a-z][a-z0-9_]+/g;
-
-function _tokens(text: string): Set<string> {
-  const out = new Set<string>();
-  const low = text.toLowerCase();
-  _WORD.lastIndex = 0;
-  let m: RegExpExecArray | null;
-  while ((m = _WORD.exec(low)) !== null) {
-    if (m[0].length > 2) out.add(m[0]);
-  }
-  return out;
-}
-
 /**
  * Whether a task exercises ≥1 trigger of the rule (prompt↔trigger
  * falsifiability, Phase 3). Kernel rules always fire.
@@ -140,16 +126,12 @@ export function task_fires_rule(
   if (kernel.has(ruleId)) return true;
   const triggers = router_triggers(router).get(ruleId) ?? [];
   const low = task.prompt.toLowerCase();
-  const toks = _tokens(task.prompt);
   const files = Array.isArray(task.context_files) ? task.context_files : [];
   const cmd = typeof task.command === 'string' ? task.command : '';
   for (const trig of triggers) {
     if ('keyword' in trig || 'phrase' in trig) {
       const needle = String(trig.keyword ?? trig.phrase).toLowerCase();
       if (needle && low.includes(needle)) return true;
-    } else if ('intent' in trig) {
-      const words = _tokens(String(trig.intent));
-      if (words.size > 0 && [...words].every((w) => toks.has(w))) return true;
     } else if ('path_prefix' in trig) {
       const prefix = String(trig.path_prefix);
       if (files.some((f) => f.startsWith(prefix))) return true;

package/src/scripts/code_graph/loader.ts

@@ -2,10 +2,11 @@
  * WASM tree-sitter loader for the code-graph engine.
  *
  * Pinned pair (ABI-verified 2026-07-23): `web-tree-sitter@0.24.7` +
- * `tree-sitter-wasms@0.1.13` → grammar ABI 14. The ABI smoke test
- * (`tests/scripts/code_graph_abi.test.ts`) asserts this pairing loads and
- * parses before merge; a bump to either dependency re-runs it. No network,
- * no node-gyp — grammars load from `node_modules` via the resolved path.
+ * `tree-sitter-wasms@0.1.13` → grammar ABI 14. The ABI smoke test lives in
+ * `tests/scripts/code_graph.test.ts`; it runs in this repo because the pair is
+ * a devDependency. Consumers install neither (see `INSTALL_HINT` below). No
+ * network, no node-gyp — grammars load from `node_modules` via the resolved
+ * path.
  *
  * web-tree-sitter 0.24.x is CJS with a single default export (the Parser
  * class) and the classic `Parser.Language.load()` API; we reach it through
@@ -51,10 +52,32 @@ interface ParserStatic {
     Language: { load(wasmPath: string): Promise<TsLanguage> };
 }
 
+/**
+ * The parser pair is a devDependency, not a runtime one: this repo's tests still
+ * exercise the loader, while a consumer install resolves neither. The engine is
+ * permanently `enabled: false` (measured recall 0.365 vs grep 0.797), so
+ * shipping ~51 MB of WASM to every consumer for a path none of them can reach
+ * was pure install cost. A consumer re-enabling the engine installs the
+ * ABI-locked pair themselves — this message carries the pin, because
+ * `check_dependency_floors` only scans the `dependencies` block.
+ */
+const INSTALL_HINT =
+    'the code-graph engine needs its parser pair, which this package no longer ships to consumers ' +
+    '(the engine is disabled by a recorded null result). Install the ABI-locked pair:\n' +
+    '  npm i web-tree-sitter@0.24.7 tree-sitter-wasms@0.1.13\n' +
+    'Both versions are exact on purpose — the pair is ABI-coupled (grammar ABI 14) ' +
+    'and must move together.';
+
 let _wasmDir: string | null = null;
 function wasmDir(): string {
     if (_wasmDir === null) {
-        _wasmDir = path.join(path.dirname(require.resolve('tree-sitter-wasms/package.json')), 'out');
+        let pkgJson: string;
+        try {
+            pkgJson = require.resolve('tree-sitter-wasms/package.json');
+        } catch {
+            throw new Error(`tree-sitter-wasms is not installed — ${INSTALL_HINT}`);
+        }
+        _wasmDir = path.join(path.dirname(pkgJson), 'out');
     }
     return _wasmDir;
 }
@@ -72,7 +95,13 @@ function _Parser(): ParserStatic {
     // Require exactly once and cache the class reference — repeated
     // createRequire calls under tsx can hand back a module view whose static
     // `Language` is not yet populated, which breaks the second grammar load.
-    if (_mod === null) _mod = require('web-tree-sitter') as ParserStatic;
+    if (_mod === null) {
+        try {
+            _mod = require('web-tree-sitter') as ParserStatic;
+        } catch {
+            throw new Error(`web-tree-sitter is not installed — ${INSTALL_HINT}`);
+        }
+    }
     return _mod;
 }
 

package/src/scripts/compile_router.ts

@@ -73,14 +73,9 @@ const LEGACY_TIER_MAP: Record<string, string> = {
 };
 
 const ALLOWED_TIERS = new Set(['kernel', 'tier-1', 'tier-2']);
-const ALLOWED_TRIGGER_KEYS = new Set([
-    'keyword',
-    'phrase',
-    'intent',
-    'file_pattern',
-    'path_prefix',
-    'command',
-]);
+// `intent` was removed: it never auto-matched at runtime, so declaring one gave
+// the author a false activation path. Compiling one is now a hard error.
+const ALLOWED_TRIGGER_KEYS = new Set(['keyword', 'phrase', 'file_pattern', 'path_prefix', 'command']);
 
 function _parse_frontmatter(text: string): JsonObject {
     if (!text.startsWith('---\n')) {

package/src/scripts/condense.ts

@@ -1176,7 +1176,7 @@ function _yaml_scalar(value: string): string {
  * Derive host-native activation globs from a rule's `triggers:` frontmatter
  * (road-to-request-scoped-rule-load Phase 2). `file_pattern` triggers map
  * verbatim; `path_prefix` triggers map to `<prefix>**`. Keyword / phrase /
- * intent / command triggers produce no glob — those rules stay
+ * command triggers produce no glob — those rules stay
  * description-activated (Cursor Agent-Requested / Windsurf model_decision).
  */
 export function derive_trigger_globs(meta: Record<string, unknown>): string[] {
@@ -1224,7 +1224,7 @@ export function _emit_windsurf_rule(source: string, target: string): void {
     const description = _strip(String(meta['description'] ?? '').replace(/\n/g, ' '));
     const always_apply = Boolean(meta['alwaysApply'] || meta['type'] === 'always');
     // Path-shaped triggers activate host-natively via Windsurf's `glob`
-    // trigger; keyword/intent-only rules keep `model_decision`.
+    // trigger; keyword/phrase-only rules keep `model_decision`.
     const globs = always_apply ? [] : derive_trigger_globs(meta);
     const trigger = always_apply ? 'always_on' : globs.length > 0 ? 'glob' : 'model_decision';
     const lines = [

package/src/scripts/count_scoped_projection.ts

@@ -0,0 +1,104 @@
+#!/usr/bin/env tsx
+/**
+ * Emit the scoped-projection skill count — the number `docs/CLAIMS.md`
+ * publishes for the default install
+ * (road-to-reproducible-artefact-counts).
+ *
+ * The claim used to read "217 of 288 skills … with the counting method
+ * pinned in the benchmark doc", while that benchmark doc said 215 of 286.
+ * Both numbers were hand-typed, only one of them tracked the catalog, and
+ * the gap grew by one on every skill added because no gate could compare
+ * them. This script is the single derivation both now come from.
+ *
+ * It adds no counting mechanism of its own — that would be a second path
+ * free to disagree with the first, which is the defect, not the fix:
+ *
+ *   - the file set is `update_counts.iter_skills()`, the exact walk behind
+ *     the canonical `count('skills')`, so `projected + pruned === total`
+ *     holds by construction;
+ *   - the in/out predicate is `_lib/scoped_projection.is_pruned_under_scoped`,
+ *     the exact function `install.ts` applies when it prunes a real user's
+ *     tree, so the published number cannot describe a projection the
+ *     installer does not perform.
+ *
+ * `runtime.active_packs` is deliberately empty here: the claim is about the
+ * DEFAULT for a new install, and a fresh machine has no overlay. An operator
+ * who activates extra packs gets more skills than the claim states — the
+ * claim is a floor, and `--json` exposes `active_packs` so a reader can see
+ * the assumption rather than infer it.
+ *
+ * Usage:
+ *   ./scripts-run src/scripts/count_scoped_projection            # "217 of 288"
+ *   ./scripts-run src/scripts/count_scoped_projection --json
+ *   ./scripts-run src/scripts/count_scoped_projection --projected
+ *
+ * Exit codes: 0 ok · 1 the pack registry could not be read.
+ */
+
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+
+import {
+    scoped_projection_stats,
+    type ScopedProjectionStats,
+} from './_lib/scoped_projection.js';
+import { iter_skills, REPO_ROOT } from './update_counts.js';
+
+const _HERE = fileURLToPath(import.meta.url);
+
+export type { ScopedProjectionStats };
+
+/** Partition the canonical skill catalog with the installer's own predicate. */
+export function stats(package_root: string = REPO_ROOT): ScopedProjectionStats {
+    return scoped_projection_stats(package_root, iter_skills());
+}
+
+export function main(argv: readonly string[] = process.argv.slice(2)): number {
+    let s: ScopedProjectionStats;
+    try {
+        s = stats();
+    } catch (err) {
+        process.stderr.write(
+            `❌  scoped-projection count unavailable: ${(err as Error).message}\n` +
+                '    (src/config/discovery/packs.yml must exist and parse to a list)\n',
+        );
+        return 1;
+    }
+
+    if (argv.includes('--json')) {
+        process.stdout.write(`${JSON.stringify(s, null, 2)}\n`);
+        return 0;
+    }
+    if (argv.includes('--projected')) {
+        process.stdout.write(`${s.projected}\n`);
+        return 0;
+    }
+    if (argv.includes('--total')) {
+        process.stdout.write(`${s.total}\n`);
+        return 0;
+    }
+    process.stdout.write(`${s.projected} of ${s.total}\n`);
+    return 0;
+}
+
+function _isCliEntry(): boolean {
+    if (process.argv[1] === undefined) {
+        return false;
+    }
+    const argvUrl = pathToFileURL(path.resolve(process.argv[1])).href;
+    if (import.meta.url === argvUrl) {
+        return true;
+    }
+    try {
+        const here = fs.realpathSync(fileURLToPath(import.meta.url));
+        const argv = fs.realpathSync(path.resolve(process.argv[1]));
+        return here === argv;
+    } catch {
+        return false;
+    }
+}
+
+if (_isCliEntry() || process.argv[1] === _HERE) {
+    process.exit(main(process.argv.slice(2)));
+}

package/src/scripts/explain_run.ts

@@ -130,7 +130,6 @@ function parseSince(since: string | null): number | null {
 export interface TriggerSpec {
     keyword?: string;
     phrase?: string;
-    intent?: string;
     file_pattern?: string;
     path_prefix?: string;
     command?: string;

package/src/scripts/generate_pack_manifests.ts

@@ -17,7 +17,7 @@
  * regenerated on every `task sync` and must never be hand-edited.
  *
  * For each pack home we emit:
- *   - `<home>/pack.yaml` — id, label, owner, requires, version, artefact_count, …
+ *   - `<home>/pack.yaml` — id, label, owner, requires, artefact_count, …
  *   - `<home>/README.md` — pack description + per-artefact description table
  *
  * CLI:
@@ -40,7 +40,6 @@ const PACKAGES = path.join(ROOT, 'packages');
 const SRC_DOMAINS = path.join(ROOT, 'src', 'domains');
 const SRC_PACKS = path.join(ROOT, 'src', 'packs');
 const PACKS_VOCAB = path.join(ROOT, 'src', 'config', 'discovery', 'packs.yml');
-const PACKAGE_JSON = path.join(ROOT, 'package.json');
 const GENERATED_HEADER =
     '# Generated by scripts/generate_pack_manifests.ts — DO NOT EDIT BY HAND\n';
 
@@ -138,14 +137,6 @@ function _vocab_lookup(packsVocab: Dict[]): Record<string, Dict> {
     return out;
 }
 
-function _package_version(): string {
-    if (!_exists(PACKAGE_JSON)) {
-        return '0.0.0';
-    }
-    const pkg = JSON.parse(fs.readFileSync(PACKAGE_JSON, 'utf-8')) as Dict;
-    return _pyTruthy(pkg.version) ? String(pkg.version) : '0.0.0';
-}
-
 function _artefact_record(p: string, logicalRel: string, fm: Dict): Artefact {
     const name = _pyTruthy(fm.name)
         ? String(fm.name)
@@ -256,12 +247,7 @@ function _category_from_logical(logicalRel: string): string {
  * Build the pack.yaml meta dict. Mirrors `_build_pack_yaml`. Insertion
  * order here is irrelevant — `_py_safe_dump` sorts keys (sort_keys=True).
  */
-function _build_pack_yaml(
-    pid: string,
-    vocab: Record<string, Dict>,
-    artefacts: Artefact[],
-    version: string,
-): Dict {
+function _build_pack_yaml(pid: string, vocab: Record<string, Dict>, artefacts: Artefact[]): Dict {
     const meta = vocab[pid] ?? {};
     const label = _pyTruthy(meta.label)
         ? String(meta.label)
@@ -289,7 +275,6 @@ function _build_pack_yaml(
         trust_level_default: _pyTruthy(meta.trust_level_default)
             ? (meta.trust_level_default as unknown)
             : 'core',
-        version,
         artefact_count: artefacts.length,
     };
     if (_isPlainObject(meta.onboarding)) {
@@ -330,7 +315,6 @@ function _render_readme(packMeta: Dict, artefacts: Artefact[]): string {
     const requires = (packMeta.requires as unknown[]) ?? [];
     lines.push(
         `- **id**: \`${String(packMeta.id)}\``,
-        `- **version**: \`${String(packMeta.version)}\``,
         `- **owner**: ${owner.map(String).join(', ') || '—'}`,
         `- **requires**: ${requires.map(String).join(', ') || '—'}`,
         `- **artefacts**: ${String(packMeta.artefact_count)}`,
@@ -369,7 +353,6 @@ function _write_if_changed(p: string, content: string, check: boolean): boolean
 export function main(argv: string[] = process.argv.slice(2)): number {
     const check = argv.includes('--check');
     const vocab = _vocab_lookup((_load_yaml(PACKS_VOCAB) as Dict[]) ?? []);
-    const version = _package_version();
     const homes = _pack_homes();
     if (homes.length === 0) {
         process.stderr.write(
@@ -380,7 +363,7 @@ export function main(argv: string[] = process.argv.slice(2)): number {
     let drift = 0;
     for (const [pid, homeDir, mode] of homes) {
         const artefacts = _collect_artefacts(pid, homeDir, mode);
-        const meta = _build_pack_yaml(pid, vocab, artefacts, version);
+        const meta = _build_pack_yaml(pid, vocab, artefacts);
         const yamlBody = GENERATED_HEADER + _py_safe_dump(meta);
         const readmeBody = _render_readme(meta, artefacts);
         const label = _relativeToPosix(homeDir, ROOT);

package/src/scripts/hooks/block_kernel_rule_writes.ts

@@ -40,6 +40,7 @@ import * as path from 'node:path';
 
 import { is_kernel_rule } from '../_lib/kernel_rules.js';
 import { EDIT_TOOLS } from '../minimal_safe_diff_hook.js';
+import { COMMAND_TOOLS } from '../verify_before_complete_hook.js';
 import { readHookStdin } from './hook_stdin.js';
 
 const _HERE = fileURLToPath(import.meta.url);
@@ -122,25 +123,159 @@ export function targets_kernel_rule(filePath: string): string | null {
     return basename.replace(/\.md$/, '');
 }
 
-/** Return (blocked, reason) for one PreToolUse envelope. Pure — no I/O beyond the arg. */
+/** In-place mutators that name their target as a plain argument. */
+const _MUTATOR_VERBS: ReadonlySet<string> = new Set([
+    'sed',
+    'tee',
+    'truncate',
+    'rm',
+    'shred',
+]);
+/** Verbs whose LAST positional argument is the destination. */
+const _DEST_LAST_VERBS: ReadonlySet<string> = new Set(['mv', 'cp', 'install', 'rsync']);
+
+/**
+ * Shell tokens that, in a command naming a kernel rule path, mean the path is
+ * being WRITTEN rather than read. Reads (`cat`, `grep`, `head`, `diff`,
+ * `git show`) carry none of these and stay allowed — a kernel rule is
+ * immutable, not secret.
+ */
+function _bash_targets_kernel_rule(command: string): string | null {
+    // Cheap reject first: no kernel-rule path in the string at all.
+    const tokens = command.split(/\s+/).filter((t) => t.length > 0);
+    const stripped = tokens.map((t) => t.replace(/^['"]|['"]$/g, ''));
+    const ruleOf = (t: string): string | null => targets_kernel_rule(t);
+    if (!stripped.some((t) => ruleOf(t) !== null)) {
+        return null;
+    }
+
+    // 1. Redirection into the path: `> p`, `>> p`, `>p`, `>>p`.
+    for (let i = 0; i < stripped.length; i += 1) {
+        const tok = stripped[i] as string;
+        const inline = /^>{1,2}(.+)$/.exec(tok);
+        if (inline) {
+            const r = ruleOf(inline[1] as string);
+            if (r !== null) {
+                return r;
+            }
+        }
+        if (tok === '>' || tok === '>>') {
+            const next = stripped[i + 1];
+            if (typeof next === 'string') {
+                const r = ruleOf(next);
+                if (r !== null) {
+                    return r;
+                }
+            }
+        }
+    }
+
+    // 2. A mutator verb anywhere in the pipeline, with the path as an argument.
+    //    `sed` only counts in its in-place form — `sed 's/x/y/' file` prints.
+    const verbs = new Set<string>();
+    let prevWasSeparator = true;
+    for (const tok of stripped) {
+        if (['&&', '||', ';', '|'].includes(tok)) {
+            prevWasSeparator = true;
+            continue;
+        }
+        if (prevWasSeparator && !tok.startsWith('-')) {
+            verbs.add(path.basename(tok));
+            prevWasSeparator = false;
+        }
+    }
+    const sedInPlace = verbs.has('sed') && stripped.some((t) => /^-i/.test(t));
+    for (const verb of verbs) {
+        if (verb === 'sed' && !sedInPlace) {
+            continue;
+        }
+        if (_MUTATOR_VERBS.has(verb)) {
+            const hit = stripped.map(ruleOf).find((r) => r !== null);
+            if (hit !== undefined && hit !== null) {
+                return hit;
+            }
+        }
+        if (_DEST_LAST_VERBS.has(verb)) {
+            const last = stripped[stripped.length - 1] as string;
+            const r = ruleOf(last);
+            if (r !== null) {
+                return r;
+            }
+        }
+    }
+    return null;
+}
+
+/**
+ * Return (blocked, reason) for one PreToolUse envelope. Pure — no I/O beyond
+ * the arg.
+ *
+ * Two surfaces, one effect. The Write/Edit branch is the original Layer-1
+ * guard. The Bash branch was added by road-to-governance-invariants Phase 1
+ * after the S0.2 spike measured the gap: this gate keyed on the TOOL NAME, so
+ * `Bash sed -i … src/rules/commit-policy.md` reached the immutable-rule
+ * outcome the Write branch refuses, and a two-step
+ * `Write docs/staging/<kernel>.md` → `Bash mv … src/rules/<kernel>.md`
+ * sequence did the same with every step individually allowed.
+ *
+ * The Bash branch is deliberately narrow (2026-08-02 council cut, option ii):
+ * only redirection into the path, an in-place `sed`, a `tee`/`truncate`/`rm`
+ * naming it, or a `mv`/`cp` whose DESTINATION it is. Reads stay allowed — a
+ * kernel rule is immutable, not secret — and no attempt is made to understand
+ * arbitrary shell. Recognising every conceivable write verb would make this a
+ * shell sandbox, which is the failure mode the council named.
+ */
 export function check_envelope(envelope: JsonObject): [boolean, string] {
     const { tool, paths } = _extract(envelope);
-    if (!tool || !EDIT_TOOLS.has(tool)) {
+    if (!tool) {
         return [false, ''];
     }
-    for (const p of paths) {
-        const ruleName = targets_kernel_rule(p);
-        if (ruleName !== null) {
-            return [
-                true,
-                `kernel rule ${ruleName} is immutable — tighten-only via the override ` +
-                    'exception registry; see docs/contracts/kernel-membership.md',
-            ];
+    const deny = (ruleName: string): [boolean, string] => [
+        true,
+        `kernel rule ${ruleName} is immutable — tighten-only via the override ` +
+            'exception registry; see docs/contracts/kernel-membership.md',
+    ];
+    if (EDIT_TOOLS.has(tool)) {
+        for (const p of paths) {
+            const ruleName = targets_kernel_rule(p);
+            if (ruleName !== null) {
+                return deny(ruleName);
+            }
+        }
+        return [false, ''];
+    }
+    if (COMMAND_TOOLS.has(tool)) {
+        const cmd = _extract_command(envelope);
+        if (cmd !== null) {
+            const ruleName = _bash_targets_kernel_rule(cmd);
+            if (ruleName !== null) {
+                return deny(ruleName);
+            }
         }
     }
     return [false, ''];
 }
 
+/** Best-effort read of a shell command off a PreToolUse envelope. */
+function _extract_command(envelope: JsonObject): string | null {
+    const payload = _isObject(envelope['payload']) ? envelope['payload'] : envelope;
+    const ti = _isObject(payload['tool_input'])
+        ? payload['tool_input']
+        : _isObject(envelope['tool_input'])
+          ? envelope['tool_input']
+          : null;
+    for (const src of [ti, payload]) {
+        if (src === null) {
+            continue;
+        }
+        const v = src['command'];
+        if (typeof v === 'string' && v) {
+            return v;
+        }
+    }
+    return null;
+}
+
 function _asObject(v: JsonValue | undefined): JsonObject | null {
     return _isObject(v) ? v : null;
 }