@event4u/agent-config 9.23.0 → 9.25.0

package/src/scripts/git_authorization_hook.ts

@@ -0,0 +1,263 @@
+#!/usr/bin/env node
+/**
+ * Git-authorization ledger — `user_prompt_submit` concern.
+ *
+ * Records which git operations the user's OWN WORDS authorize this turn, so
+ * `hooks/block_unauthorized_git.ts` can check an operation against a fact
+ * instead of against the model's recollection of the conversation.
+ *
+ * WHY — the measured defect (30-session conformance audit, 2026-08-06):
+ *
+ *   - A full release chain (prod-trunk merge, tag push, GitHub release, npm
+ *     publish) executed after the agent itself wrote "das ist ein Hard-Floor-
+ *     Schritt, dafür brauche ich Dein explizites Go" and never received one —
+ *     the user's next turn was a pasted `git push … rejected` stack trace,
+ *     which was read as implicit continuation.
+ *   - Two complete PRs opened on turns carrying no git authorization at all.
+ *   - Force-push over a bot's commits off a bare "fixe auch diese 4 pr's".
+ *   - Twice the constraint was named in writing and contradicted minutes later.
+ *
+ * `commit-policy` and `scope-control` already forbid all of this in prose, and
+ * the prose was in context every time. The ledger is the missing fact, not a
+ * new obligation.
+ *
+ * State: `agents/state/git-authorization.json`
+ *   { "session_id": str, "detected_at": iso8601, "authorized": [op, …],
+ *     "evidence": { op: "phrase" }, "prompt_chars": int }
+ *
+ * Each user turn REPLACES the ledger — that is the point. `commit-policy`'s
+ * "one-shot authorization is not a standing license" says an authorization is
+ * spent on the operation it named; carrying it forward is the exact inference
+ * the rule forbids, so a new prompt with no authorization phrase yields an
+ * empty ledger rather than an inherited one.
+ *
+ * Never blocks. Exit 0 always. The blocking half lives in the pre_tool_use
+ * concern, which is where the operation is actually observable.
+ */
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+
+import { atomic_write_json } from "./hooks/state_io.js";
+import { readHookStdin } from "./hooks/hook_stdin.js";
+
+const EXIT_ALLOW = 0;
+
+export const STATE_FILE = path.join("agents", "state", "git-authorization.json");
+
+type JsonValue = string | number | boolean | null | JsonValue[] | { [k: string]: JsonValue };
+type JsonObject = { [k: string]: JsonValue };
+
+function _isObject(v: unknown): v is JsonObject {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+
+/** The operations the ledger can authorize. */
+export type GitOp =
+  | "commit"
+  | "push"
+  | "branch"
+  | "pr-create"
+  | "pr-merge"
+  | "tag"
+  | "release"
+  | "publish";
+
+export const ALL_OPS: readonly GitOp[] = [
+  "commit",
+  "push",
+  "branch",
+  "pr-create",
+  "pr-merge",
+  "tag",
+  "release",
+  "publish",
+];
+
+/**
+ * Prose phrases, German and English, that authorize an operation.
+ *
+ * Deliberately a keyword list rather than an LLM judge: the classifier runs on
+ * every prompt and must be cheap, deterministic and reviewable. A miss costs a
+ * warn (or, on the irreversible subset, one confirmation); an LLM judge would
+ * cost latency on every turn and be unauditable.
+ */
+const PHRASES: ReadonlyArray<{ op: GitOp; re: RegExp }> = [
+  { op: "commit", re: /\b(commit(e|et|ten|ted|ting)?|committe|einchecken)\b/i },
+  { op: "push", re: /\b(push(e|en|ed|ing)?|hochladen|hochschieben|raufschieben)\b/i },
+  { op: "branch", re: /\b(branch(e|es)?|zweig|feature-branch|erstelle einen branch)\b/i },
+  { op: "pr-create", re: /\b(pull[- ]request|pr\b|mach(e|en)? (einen|nen) pr|erstelle .{0,20}pr)\b/i },
+  { op: "pr-merge", re: /\b(merge[nrd]?|mergen|zusammenführen|zusammenfuehren|reinmergen|gemerged)\b/i },
+  { op: "tag", re: /\b(tag(ge|gen|ged|ging)?|version(iere|ieren)?)\b/i },
+  { op: "release", re: /\b(release[nd]?|releasen|veröffentlich(e|en|ung)|veroeffentlich(e|en))\b/i },
+  { op: "publish", re: /\b(publish(e|en|ed|ing)?|npm publish|publiziere[n]?)\b/i },
+];
+
+/** Executable commands a user may paste, mapped to the op they authorize. */
+const PASTED_COMMANDS: ReadonlyArray<{ op: GitOp; re: RegExp }> = [
+  { op: "publish", re: /\bnpm\s+publish\b/i },
+  { op: "tag", re: /\bgit\s+push\s+[^\n]*--tags\b|\bgit\s+tag\s+-a\b/i },
+  { op: "release", re: /\bgh\s+release\s+create\b/i },
+  { op: "pr-merge", re: /\bgh\s+pr\s+merge\b/i },
+  { op: "pr-create", re: /\bgh\s+pr\s+create\b/i },
+  { op: "push", re: /\bgit\s+push\b/i },
+  { op: "commit", re: /\bgit\s+commit\b/i },
+  { op: "branch", re: /\bgit\s+(checkout\s+-b|switch\s+-c|branch)\b/i },
+];
+
+/**
+ * Split a prompt into prose and fenced-code regions.
+ *
+ * The council's point: a user who PASTES an executable `git push origin main`
+ * is authorizing that command; the same literal appearing inside a log line or
+ * an error trace is not authorization. The discriminator used here is whether
+ * the line reads as a command invocation (starts at the command, optionally
+ * after a shell prompt marker) rather than being embedded in prose or in a
+ * `remote:` / `error:` / `hint:` diagnostic line.
+ */
+export function splitFences(prompt: string): { prose: string; fences: string[] } {
+  const fences: string[] = [];
+  const prose = prompt.replace(/```[^\n]*\n([\s\S]*?)```/g, (_m, body: string) => {
+    fences.push(body);
+    return " ";
+  });
+  return { prose, fences };
+}
+
+/** A fenced line that is an actual command invocation, not diagnostic output. */
+function _commandLines(fence: string): string[] {
+  return fence
+    .split("\n")
+    .map((l) => l.trim())
+    .filter((l) => l.length > 0)
+    // Drop git/npm diagnostic output — this is what "pasted an error trace" looks like.
+    .filter((l) => !/^(remote:|error:|hint:|fatal:|warning:|To |!\s|\s*\^)/i.test(l))
+    // Strip a leading shell prompt marker.
+    .map((l) => l.replace(/^[$>#]\s*/, ""))
+    // Keep only lines that START with the command.
+    .filter((l) => /^(git|gh|npm|pnpm|yarn|task)\b/.test(l));
+}
+
+export interface Ledger extends JsonObject {
+  session_id: string;
+  detected_at: string;
+  authorized: GitOp[];
+  evidence: { [op: string]: string };
+  prompt_chars: number;
+}
+
+/** Classify which ops a prompt authorizes. Exported for direct testing. */
+export function classifyAuthorization(prompt: string): {
+  authorized: GitOp[];
+  evidence: Record<string, string>;
+} {
+  const { prose, fences } = splitFences(prompt);
+  const authorized = new Set<GitOp>();
+  const evidence: Record<string, string> = {};
+
+  for (const { op, re } of PHRASES) {
+    const m = re.exec(prose);
+    if (m) {
+      authorized.add(op);
+      evidence[op] = `prose: "${m[0]}"`;
+    }
+  }
+
+  for (const fence of fences) {
+    for (const line of _commandLines(fence)) {
+      for (const { op, re } of PASTED_COMMANDS) {
+        if (re.test(line)) {
+          authorized.add(op);
+          evidence[op] = `pasted command: "${line.slice(0, 80)}"`;
+        }
+      }
+    }
+  }
+
+  return { authorized: [...authorized], evidence };
+}
+
+export function run(stdin_text: string, options: { consumer_root: string }): number {
+  let envelope: JsonObject = {};
+  if (stdin_text.trim()) {
+    try {
+      const decoded = JSON.parse(stdin_text) as unknown;
+      if (_isObject(decoded)) {
+        envelope = decoded;
+      }
+    } catch {
+      return EXIT_ALLOW;
+    }
+  }
+
+  const payload = _isObject(envelope["payload"]) ? (envelope["payload"] as JsonObject) : envelope;
+  let prompt = "";
+  for (const key of ["prompt", "userPrompt", "user_prompt", "message", "text"]) {
+    const v = payload[key];
+    if (typeof v === "string" && v.trim()) {
+      prompt = v;
+      break;
+    }
+  }
+  if (!prompt) {
+    return EXIT_ALLOW;
+  }
+
+  const { authorized, evidence } = classifyAuthorization(prompt);
+  const ledger: Ledger = {
+    session_id: typeof envelope["session_id"] === "string" ? envelope["session_id"] : "",
+    detected_at: new Date().toISOString(),
+    authorized,
+    evidence,
+    prompt_chars: prompt.length,
+  };
+
+  try {
+    atomic_write_json(path.join(options.consumer_root, STATE_FILE), ledger);
+  } catch {
+    // Observability only — a failed write degrades the gate to "no ledger",
+    // which the pre_tool_use concern treats as "not authorized" for the
+    // irreversible subset and as a warn for the rest.
+  }
+  return EXIT_ALLOW;
+}
+
+export function main(argv?: string[]): number {
+  const args = argv ?? process.argv.slice(2);
+  let consumer_root = process.cwd();
+  for (let i = 0; i < args.length; i += 1) {
+    const a = args[i];
+    if (a === "--project-dir" && args[i + 1] !== undefined) {
+      consumer_root = args[i + 1] as string;
+      i += 1;
+    } else if (a !== undefined && a.startsWith("--project-dir=")) {
+      consumer_root = a.slice("--project-dir=".length);
+    }
+  }
+  return run(readHookStdin(), { consumer_root });
+}
+
+declare const __AGENT_CONFIG_BUNDLE__: boolean | undefined;
+function _isCliEntry(): boolean {
+  if (typeof __AGENT_CONFIG_BUNDLE__ !== "undefined" && __AGENT_CONFIG_BUNDLE__) {
+    return false;
+  }
+  if (process.argv[1] === undefined) {
+    return false;
+  }
+  const argvUrl = pathToFileURL(path.resolve(process.argv[1])).href;
+  if (import.meta.url === argvUrl) {
+    return true;
+  }
+  try {
+    const here = fs.realpathSync(fileURLToPath(import.meta.url));
+    const argv = fs.realpathSync(path.resolve(process.argv[1]));
+    return here === argv;
+  } catch {
+    return false;
+  }
+}
+
+if (_isCliEntry()) {
+  process.exit(main());
+}

package/src/scripts/hook_manifest.yaml

@@ -240,6 +240,45 @@ concerns:
     args: []
     fail_closed: false
     severity: advisory
+  # Language-mirror pin — carries the ONE fact the transcript cannot express:
+  # which language the human actually typed. 47 skill/slash-command bodies were
+  # measured arriving in the `user` role across 21 of 30 audited sessions, and
+  # in the worst case a 4,196-char English skill body was the last user-role
+  # content before 136 consecutive English replies to a German prompt.
+  # `user_prompt_submit` is the only event a skill body never reaches.
+  # Advisory: it supplies a fact, it never blocks.
+  language-mirror:
+    script: src/scripts/language_mirror_hook.ts
+    args: []
+    fail_closed: false
+    severity: advisory
+  # Git-authorization ledger — records which git ops the user's OWN WORDS
+  # authorize this turn. Writes state only; never blocks.
+  git-authorization:
+    script: src/scripts/git_authorization_hook.ts
+    args: []
+    fail_closed: false
+    severity: advisory
+  # The blocking half. BLOCKS only the irreversible subset that
+  # non-destructive-by-default already declares never-autonomous (npm publish,
+  # tag push, gh release create, gh pr merge); WARNS on commit / push /
+  # pr-create / branch. Severity, not reach — see the header of the script.
+  block-unauthorized-git:
+    script: src/scripts/hooks/block_unauthorized_git.ts
+    args: []
+    fail_closed: true
+    severity: blocking
+  # Evaluator independence. Gates EVALUATION dispatches only — a verdict
+  # pre-loaded into the prompt, or a second evaluation of the same work in one
+  # turn. Ordinary parallel fan-out is untouched: the council's "second dispatch
+  # of any kind" criterion would have blocked 6 of the 7 analysis subagents in
+  # the very session that produced this guard. fail_closed: false — a malformed
+  # envelope must never block a dispatch.
+  evidence-independence:
+    script: src/scripts/hooks/evidence_independence.ts
+    args: []
+    fail_closed: false
+    severity: blocking
   # session_start canary injection — deterministic carrier for the
   # session-canary rule (greet-by-name at task start + reply-close markers
   # as a user-observable context-degradation signal). Gated on
@@ -258,15 +297,15 @@ platforms:
     session_start:    [chat-history, hot-context, handoff-context, session-canary, first-run-gate, onboarding-gate, verify-before-complete, minimal-safe-diff, profile-staleness, wrapper-freshness, surface-probe]
     session_end:      [chat-history, memory-learn]
     stop:             [chat-history, hot-context, verify-before-complete]
-    pre_tool_use:     [block-no-verify, block-kernel-rule-writes, block-config-weakening, rtk-wrap, design-slop, code-graph-nudge]
+    pre_tool_use:     [block-no-verify, block-unauthorized-git, evidence-independence, block-kernel-rule-writes, block-config-weakening, rtk-wrap, design-slop, code-graph-nudge]
     post_tool_use:    [chat-history, roadmap-progress, context-hygiene, verify-before-complete, minimal-safe-diff, injection-scan, pr-url-reminder]
 
   claude:
     session_start:    [chat-history, hot-context, handoff-context, session-canary, first-run-gate, onboarding-gate, verify-before-complete, minimal-safe-diff, profile-staleness, wrapper-freshness, surface-probe]
     session_end:      [chat-history, memory-learn]
     stop:             [chat-history, hot-context, verify-before-complete, team-review-gate]
-    user_prompt_submit: [chat-history, verify-before-complete, minimal-safe-diff]
-    pre_tool_use:     [block-no-verify, block-kernel-rule-writes, block-config-weakening, rtk-wrap, design-slop, code-graph-nudge]
+    user_prompt_submit: [chat-history, verify-before-complete, minimal-safe-diff, language-mirror, git-authorization]
+    pre_tool_use:     [block-no-verify, block-unauthorized-git, evidence-independence, block-kernel-rule-writes, block-config-weakening, rtk-wrap, design-slop, code-graph-nudge]
     post_tool_use:    [chat-history, roadmap-progress, context-hygiene, verify-before-complete, minimal-safe-diff, injection-scan, pr-url-reminder]
 
   # Cowork — the Claude desktop app's local-agent-mode runtime, built
@@ -287,8 +326,8 @@ platforms:
     session_start:    [chat-history, hot-context, handoff-context, session-canary, first-run-gate, onboarding-gate, verify-before-complete, minimal-safe-diff, profile-staleness, wrapper-freshness, surface-probe]
     session_end:      [chat-history, memory-learn]
     stop:             [chat-history, hot-context, verify-before-complete]
-    user_prompt_submit: [chat-history, verify-before-complete, minimal-safe-diff]
-    pre_tool_use:     [block-no-verify, block-kernel-rule-writes, block-config-weakening, rtk-wrap, design-slop, code-graph-nudge]
+    user_prompt_submit: [chat-history, verify-before-complete, minimal-safe-diff, language-mirror, git-authorization]
+    pre_tool_use:     [block-no-verify, block-unauthorized-git, evidence-independence, block-kernel-rule-writes, block-config-weakening, rtk-wrap, design-slop, code-graph-nudge]
     post_tool_use:    [chat-history, roadmap-progress, context-hygiene, verify-before-complete, minimal-safe-diff, injection-scan, pr-url-reminder]
 
   # Phase 7.5 — Cursor. `.cursor/hooks.json` (project) is read by the
@@ -302,7 +341,7 @@ platforms:
     session_start:      [chat-history, hot-context, handoff-context, session-canary, first-run-gate, onboarding-gate, verify-before-complete, minimal-safe-diff, profile-staleness, wrapper-freshness, surface-probe]
     session_end:        [chat-history, memory-learn]
     stop:               [chat-history, hot-context, verify-before-complete]
-    user_prompt_submit: [chat-history, verify-before-complete, minimal-safe-diff]
+    user_prompt_submit: [chat-history, verify-before-complete, minimal-safe-diff, language-mirror, git-authorization]
     post_tool_use:      [chat-history, roadmap-progress, context-hygiene, verify-before-complete, minimal-safe-diff, injection-scan, pr-url-reminder]
 
   # Phase 7.6 — Cline. Hooks live under `.clinerules/hooks/<HookName>`
@@ -317,7 +356,7 @@ platforms:
     session_start:      [chat-history, hot-context, handoff-context, session-canary, first-run-gate, onboarding-gate, verify-before-complete, minimal-safe-diff, profile-staleness, wrapper-freshness, surface-probe]
     session_end:        [chat-history, memory-learn]
     stop:               [chat-history, hot-context, verify-before-complete]
-    user_prompt_submit: [chat-history, verify-before-complete, minimal-safe-diff]
+    user_prompt_submit: [chat-history, verify-before-complete, minimal-safe-diff, language-mirror, git-authorization]
     post_tool_use:      [chat-history, roadmap-progress, context-hygiene, verify-before-complete, minimal-safe-diff, injection-scan, pr-url-reminder]
 
   # Phase 7.7 — Windsurf (Cascade). Hooks live at `.windsurf/hooks.json`
@@ -335,7 +374,9 @@ platforms:
   windsurf:
     session_start:      [chat-history, hot-context, handoff-context, session-canary, first-run-gate, onboarding-gate, verify-before-complete, profile-staleness, wrapper-freshness, surface-probe]
     stop:               [chat-history, hot-context, verify-before-complete]
-    user_prompt_submit: [chat-history, verify-before-complete]
+    # language-mirror IS bound here: unlike minimal-safe-diff it needs only the
+    # user_prompt_submit slot, which Windsurf has.
+    user_prompt_submit: [chat-history, verify-before-complete, language-mirror, git-authorization]
 
   # Phase 7.8 — Gemini CLI. Hooks live at `.gemini/settings.json`
   # (project) or `~/.gemini/settings.json` (user). Per Gemini docs
@@ -351,7 +392,7 @@ platforms:
     session_start:      [chat-history, hot-context, handoff-context, session-canary, first-run-gate, onboarding-gate, verify-before-complete, minimal-safe-diff, profile-staleness, wrapper-freshness, surface-probe]
     session_end:        [chat-history, memory-learn]
     stop:               [chat-history, hot-context, verify-before-complete]
-    user_prompt_submit: [chat-history, verify-before-complete, minimal-safe-diff]
+    user_prompt_submit: [chat-history, verify-before-complete, minimal-safe-diff, language-mirror, git-authorization]
     post_tool_use:      [chat-history, roadmap-progress, context-hygiene, verify-before-complete, minimal-safe-diff, injection-scan, pr-url-reminder]
 
   # Phase 7.9 — Copilot has no hook surface. Concerns route through

package/src/scripts/hooks/block_unauthorized_git.ts

@@ -0,0 +1,254 @@
+#!/usr/bin/env node
+/**
+ * Unauthorized-git gate — `pre_tool_use` concern.
+ *
+ * Checks a git / GitHub / npm operation against the authorization ledger that
+ * `git_authorization_hook.ts` writes on `user_prompt_submit`, so the question
+ * "did the user authorize this THIS turn?" is answered from a recorded fact
+ * rather than from the model's recollection.
+ *
+ * SEVERITY SPLIT — by reversibility, not by confidence.
+ *
+ * The AI council (2026-08-06) split on block-vs-warn: one member argued block
+ * from day one because a published npm release had already happened; the other
+ * argued warn-first to gather false-positive data. The repo's locked
+ * `ratchet severity, never reach` decision settles it without overriding
+ * either:
+ *
+ *   BLOCK — only operations that `non-destructive-by-default` ALREADY declares
+ *   never-autonomous and that cannot be undone: `npm publish`, a tag push,
+ *   `gh release create`, `gh pr merge`. Blocking these adds no new prohibition;
+ *   it makes an existing one mechanical. That is severity, not reach.
+ *
+ *   WARN — `git commit`, `git push`, `gh pr create`, branch creation,
+ *   force-push. Real violations were measured here too (two PRs opened on turns
+ *   with zero authorization), but these are recoverable, and a false positive on
+ *   `git commit` would be a workflow cliff.
+ *
+ * KNOWN CONSERVATIVE OVER-BLOCK: `gh pr merge` does not name its base in the
+ * command, so a merge into a non-production base is blocked as if it were a
+ * production-trunk merge. Stated rather than silently narrowed — the escape is
+ * one authorizing word in the prompt, and in this repo virtually every PR
+ * targets `main`.
+ *
+ * NO LEDGER = NOT AUTHORIZED for the block subset, warn for the rest. A hook
+ * that fails open on its own state file would be decorative on exactly the
+ * turns where the state write failed.
+ *
+ * Exit codes (dispatcher contract): 0 allow · 2 block (stderr carries the
+ * reason on block-capable events) — the dispatcher's `host_semantics`
+ * translation owns the per-platform mapping.
+ */
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+
+import { readHookStdin } from "./hook_stdin.js";
+import { STATE_FILE, type GitOp } from "../git_authorization_hook.js";
+
+const EXIT_ALLOW = 0;
+const EXIT_BLOCK = 2;
+
+type JsonValue = string | number | boolean | null | JsonValue[] | { [k: string]: JsonValue };
+type JsonObject = { [k: string]: JsonValue };
+
+function _isObject(v: unknown): v is JsonObject {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+
+/** Irreversible operations — blocked without a this-turn authorization. */
+export const BLOCK_OPS: ReadonlySet<GitOp> = new Set<GitOp>([
+  "publish",
+  "tag",
+  "release",
+  "pr-merge",
+]);
+
+/** Recoverable operations — warned without a this-turn authorization. */
+export const WARN_OPS: ReadonlySet<GitOp> = new Set<GitOp>([
+  "commit",
+  "push",
+  "pr-create",
+  "branch",
+]);
+
+/**
+ * Command → operation. Order matters: the most specific pattern wins, so
+ * `git push --tags` is a tag push and not a plain push.
+ */
+const COMMAND_OPS: ReadonlyArray<{ op: GitOp; re: RegExp }> = [
+  { op: "publish", re: /\b(npm|pnpm|yarn)\s+publish\b/i },
+  { op: "release", re: /\bgh\s+release\s+create\b/i },
+  { op: "tag", re: /\bgit\s+push\b[^\n;|&]*--tags\b|\bgit\s+push\b[^\n;|&]*\brefs\/tags\//i },
+  { op: "pr-merge", re: /\bgh\s+pr\s+merge\b/i },
+  { op: "pr-create", re: /\bgh\s+pr\s+create\b/i },
+  { op: "push", re: /\bgit\s+push\b/i },
+  { op: "commit", re: /\bgit\s+commit\b/i },
+  { op: "branch", re: /\bgit\s+(checkout\s+-b|switch\s+-c)\b/i },
+];
+
+const COMMAND_TOOLS: ReadonlySet<string> = new Set([
+  "launch-process",
+  "launch_process",
+  "Bash",
+  "BashTool",
+  "run-process",
+  "runProcess",
+  "shell",
+  "execute_shell",
+  "RunShellCommand",
+]);
+
+/** Extract the shell command from a platform-native pre-tool envelope. */
+export function extractCommand(envelope: JsonObject): string | null {
+  const payload = _isObject(envelope["payload"]) ? (envelope["payload"] as JsonObject) : envelope;
+  const toolRaw = payload["tool_name"] ?? payload["toolName"] ?? payload["tool"];
+  const tool = typeof toolRaw === "string" ? toolRaw : null;
+  if (tool !== null && !COMMAND_TOOLS.has(tool)) {
+    return null;
+  }
+  const input = _isObject(payload["tool_input"])
+    ? (payload["tool_input"] as JsonObject)
+    : _isObject(payload["toolInput"])
+      ? (payload["toolInput"] as JsonObject)
+      : payload;
+  for (const key of ["command", "cmd", "script"]) {
+    const v = input[key];
+    if (typeof v === "string" && v.trim()) {
+      return v;
+    }
+  }
+  return null;
+}
+
+/** Classify a shell command into the operation it performs, if any. */
+export function commandOp(command: string): GitOp | null {
+  for (const { op, re } of COMMAND_OPS) {
+    if (re.test(command)) {
+      return op;
+    }
+  }
+  return null;
+}
+
+function _loadLedger(consumer_root: string): { authorized: Set<GitOp>; present: boolean } {
+  try {
+    const raw = fs.readFileSync(path.join(consumer_root, STATE_FILE), "utf8");
+    const decoded = JSON.parse(raw) as unknown;
+    if (_isObject(decoded) && Array.isArray(decoded["authorized"])) {
+      return {
+        authorized: new Set((decoded["authorized"] as string[]).filter(Boolean) as GitOp[]),
+        present: true,
+      };
+    }
+  } catch {
+    /* fall through */
+  }
+  return { authorized: new Set<GitOp>(), present: false };
+}
+
+export interface Decision {
+  exit: number;
+  stdout: string;
+  stderr: string;
+}
+
+export function decide(
+  command: string | null,
+  ledger: { authorized: Set<GitOp>; present: boolean },
+): Decision {
+  if (command === null) {
+    return { exit: EXIT_ALLOW, stdout: "", stderr: "" };
+  }
+  const op = commandOp(command);
+  if (op === null || ledger.authorized.has(op)) {
+    return { exit: EXIT_ALLOW, stdout: "", stderr: "" };
+  }
+
+  const shown = command.length > 120 ? `${command.slice(0, 117)}…` : command;
+
+  if (BLOCK_OPS.has(op)) {
+    const reason =
+      `Blocked: \`${op}\` with no authorization in this turn's prompt. ` +
+      `This operation is irreversible and non-destructive-by-default already declares it ` +
+      `never-autonomous. Command: ${shown}. ` +
+      `Ask the user, in one numbered-options block, and run it only after they answer this turn.`;
+    return { exit: EXIT_BLOCK, stdout: "", stderr: `${reason}\n` };
+  }
+
+  if (WARN_OPS.has(op)) {
+    const reason =
+      `No \`${op}\` authorization found in this turn's prompt (commit-policy: a one-shot ` +
+      `authorization is spent on the operation it named). If the user did authorize it this ` +
+      `turn, proceed; otherwise stop and ask. Command: ${shown}`;
+    return {
+      exit: EXIT_ALLOW,
+      stdout: `${JSON.stringify({ decision: "warn", reason })}\n`,
+      stderr: "",
+    };
+  }
+
+  return { exit: EXIT_ALLOW, stdout: "", stderr: "" };
+}
+
+export function run(stdin_text: string, options: { consumer_root: string }): number {
+  let envelope: JsonObject = {};
+  if (stdin_text.trim()) {
+    try {
+      const decoded = JSON.parse(stdin_text) as unknown;
+      if (_isObject(decoded)) {
+        envelope = decoded;
+      }
+    } catch {
+      return EXIT_ALLOW;
+    }
+  }
+  const decision = decide(extractCommand(envelope), _loadLedger(options.consumer_root));
+  if (decision.stdout) {
+    process.stdout.write(decision.stdout);
+  }
+  if (decision.stderr) {
+    process.stderr.write(decision.stderr);
+  }
+  return decision.exit;
+}
+
+export function main(argv?: string[]): number {
+  const args = argv ?? process.argv.slice(2);
+  let consumer_root = process.cwd();
+  for (let i = 0; i < args.length; i += 1) {
+    const a = args[i];
+    if (a === "--project-dir" && args[i + 1] !== undefined) {
+      consumer_root = args[i + 1] as string;
+      i += 1;
+    } else if (a !== undefined && a.startsWith("--project-dir=")) {
+      consumer_root = a.slice("--project-dir=".length);
+    }
+  }
+  return run(readHookStdin(), { consumer_root });
+}
+
+declare const __AGENT_CONFIG_BUNDLE__: boolean | undefined;
+function _isCliEntry(): boolean {
+  if (typeof __AGENT_CONFIG_BUNDLE__ !== "undefined" && __AGENT_CONFIG_BUNDLE__) {
+    return false;
+  }
+  if (process.argv[1] === undefined) {
+    return false;
+  }
+  const argvUrl = pathToFileURL(path.resolve(process.argv[1])).href;
+  if (import.meta.url === argvUrl) {
+    return true;
+  }
+  try {
+    const here = fs.realpathSync(fileURLToPath(import.meta.url));
+    const argv = fs.realpathSync(path.resolve(process.argv[1]));
+    return here === argv;
+  } catch {
+    return false;
+  }
+}
+
+if (_isCliEntry()) {
+  process.exit(main());
+}

package/src/scripts/hooks/concern_registry.ts

@@ -41,6 +41,10 @@ import { main as surfaceProbeMain } from '../surface_probe_hook.js';
 import { main as teamReviewGateMain } from '../team_review_gate_hook.js';
 import { main as prUrlReminderMain } from '../pr_url_reminder_hook.js';
 import { main as sessionCanaryMain } from '../session_canary_hook.js';
+import { main as languageMirrorMain } from '../language_mirror_hook.js';
+import { main as gitAuthorizationMain } from '../git_authorization_hook.js';
+import { main as blockUnauthorizedGitMain } from './block_unauthorized_git.js';
+import { main as evidenceIndependenceMain } from './evidence_independence.js';
 import { main as blockNoVerifyMain } from './block_no_verify.js';
 import { main as blockKernelRuleWritesMain } from './block_kernel_rule_writes.js';
 import { main as blockConfigWeakeningMain } from './block_config_weakening.js';
@@ -70,6 +74,10 @@ export const CONCERN_REGISTRY: Readonly<Record<string, ConcernMain>> = {
     'src/scripts/team_review_gate_hook.ts': teamReviewGateMain as ConcernMain,
     'src/scripts/pr_url_reminder_hook.ts': prUrlReminderMain as ConcernMain,
     'src/scripts/session_canary_hook.ts': sessionCanaryMain as ConcernMain,
+    'src/scripts/language_mirror_hook.ts': languageMirrorMain as ConcernMain,
+    'src/scripts/git_authorization_hook.ts': gitAuthorizationMain as ConcernMain,
+    'src/scripts/hooks/block_unauthorized_git.ts': blockUnauthorizedGitMain as ConcernMain,
+    'src/scripts/hooks/evidence_independence.ts': evidenceIndependenceMain as ConcernMain,
     'src/scripts/hooks/block_no_verify.ts': blockNoVerifyMain as ConcernMain,
     'src/scripts/hooks/block_kernel_rule_writes.ts': blockKernelRuleWritesMain as ConcernMain,
     'src/scripts/hooks/block_config_weakening.ts': blockConfigWeakeningMain as ConcernMain,