@intutic/sync-daemon 2.4.0 → 2.5.1

package/dist/harness/gateBody.js

@@ -48,9 +48,10 @@
  *
  * @module
  */
-import { HOLD_APPROVAL_HINT_TEMPLATE, HOLD_ID_PLACEHOLDER } from '@intutic/shared-types';
+import { HOLD_APPROVAL_HINT_TEMPLATE, HOLD_ID_PLACEHOLDER, INTERVENTION_MODE_RECORD_TAG, OPAQUE_REFUSAL_MESSAGE, } from '@intutic/shared-types';
 import { DESTRUCTIVE_COMMAND_PATTERNS, NORMALISE_CONTRACT, ruleFlags, staticFloorPatterns, } from './protectedPaths.js';
-import { ARGUMENTS_SIZE_LIMIT, COMMAND_SIZE_LIMIT, gateDeadlineMs, MCP_ALLOWLIST_JS_SOURCE, MCP_ALLOWLIST_RECORD_TAG, MCP_REGISTRY_JS_SOURCE, MCP_REGISTRY_RECORD_TAG, MCP_SNAPSHOT_UNVERIFIED_JS_SOURCE, PHRASES_JS_SOURCE, SEQUENCE_JS_SOURCE, } from '@intutic/shared-types';
+import { ARGUMENTS_SIZE_LIMIT, CHAOS_GATE_JS_SOURCE, COMMAND_SIZE_LIMIT, gateDeadlineMs, MCP_ALLOWLIST_JS_SOURCE, MCP_ALLOWLIST_RECORD_TAG, MCP_REGISTRY_JS_SOURCE, MCP_REGISTRY_RECORD_TAG, MCP_SNAPSHOT_UNVERIFIED_JS_SOURCE, PHRASES_JS_SOURCE, SEQUENCE_JS_SOURCE, } from '@intutic/shared-types';
+import { CHAOS_PY_SOURCE } from '../lib/chaosPy.js';
 import { MCP_REGISTRY_PY_SOURCE } from '../lib/mcpRegistryPy.js';
 import { PHRASES_PY_SOURCE } from '../lib/phrasesPy.js';
 import { SEQUENCE_PY_SOURCE } from '../lib/sequencePy.js';
@@ -220,8 +221,38 @@ import { SEQUENCE_PY_SOURCE } from '../lib/sequencePy.js';
  * a call at the size limit had forked a hundred `grep`s and spent seconds of
  * a loaded machine before any rule could match. The `.rules` format is
  * unchanged.
+ *
+ * v19: agent fault injection. When a chaos run's runner sets
+ * `INTUTIC_CHAOS_PLAN` and `INTUTIC_CHAOS_EVENTS` in the agent's sandbox, the
+ * JS and bash gates report every call (`plan_loaded`, `gate_decision`,
+ * `tool_call`) to the events file and inject the plan's `tool.error` and
+ * `permission.deny_or_delay` faults into calls they allowed
+ * (`@intutic/shared-types` chaosGate.ts; `chaos.py` in the bash gates). A
+ * plan that is set but unreadable refuses the call. Without the variables
+ * nothing changes; the `.rules` format is unchanged.
+ *
+ * v20: a chaos run's permission delay no longer waits inside the gate. A
+ * v19 gate slept for `delay_s` in `delay` and `hold_then_deny` modes, cut
+ * short just under the hook timeout. A v20 gate holds the call the way an
+ * approval hold does: refused as held (`HELD` in a JSON decision), and so is
+ * the identical retry (the same tool, command and target, the key an
+ * approval hold uses) until `delay_s` has passed since the first refusal;
+ * then the retry is allowed, or denied with the plan's canary. The hold's
+ * state is a file beside the run's other counters (chaosGate.ts). Without a
+ * chaos plan nothing changes; the `.rules` format is unchanged.
+ *
+ * v21: the OPAQUE intervention mode. The snapshot of an OPAQUE workspace
+ * carries an `@intervention_mode` data line (tag and `OPAQUE`, two columns,
+ * inside the digest; `encodeInterventionModeRecord` in `@intutic/shared-types`),
+ * and a gate reading one refuses on workspace policy with
+ * `OPAQUE_REFUSAL_MESSAGE` in place of the rule's reason and id: what the agent
+ * reads on stderr, in a JSON decision's reason (whose `ruleId` is null) and in
+ * a thrown error. The code, exit status and contract are unchanged, and the
+ * audit line keeps the full reason. A TRANSPARENT or SILENT_LOG snapshot has no
+ * such line and is unchanged. A v20 gate skips the line, as it skips any
+ * two-column one, and names the rule.
  */
-export const GATE_VERSION = 18;
+export const GATE_VERSION = 21;
 /**
  * The refusal codes a hook gate's JSON decision carries, as `code` beside the
  * deciding `ruleId` (null when no rule decided), for the harnesses that read
@@ -246,7 +277,12 @@ export const GATE_VERSION = 18;
  * - `GATE_DEADLINE`: the gate did not decide within its harness's deadline
  *   (`gateDeadlineMs` in `@intutic/shared-types`);
  * - `UNREADABLE_CALL`: the payload held no tool call the gate could read;
- * - `GATE_CRASHED`: the gate failed while deciding.
+ * - `GATE_CRASHED`: the gate failed while deciding, or a chaos run's
+ *   `INTUTIC_CHAOS_PLAN` is set but unreadable.
+ *
+ * A fault a chaos run injects into an allowed call is not a refusal by
+ * governance: its JSON decision carries `code: null` and `ruleId: null`, or
+ * `code: 'HELD'` and `ruleId: null` when a permission fault holds the call.
  */
 export const HOOK_REFUSAL_CODES = [
     'BUILT_IN_RULE',
@@ -321,6 +357,8 @@ export const REVIEW_REQUEST_VERSION = 1;
  *   decision on an MCP call.
  * - `intutic_mcp_unverified(tool)` — the refusal of an MCP call on a
  *   snapshot that failed its integrity check.
+ * - `intutic_chaos_begin()` and `intutic_chaos_call(...)` — a chaos run's
+ *   plan check and per-call record and fault ({@link CHAOS_PY_SOURCE}).
  *
  * The classifier used to be `grep -E` with a gap regex over the normalised
  * command, and bash's own pattern substitution on it took a minute on a long
@@ -368,6 +406,35 @@ def intutic_mcp_unverified(tool):
     # is not an MCP call.
     call = split_mcp_tool_name(tool)
     return "\\t".join(unverified_refusal(call[0])) if call else ""
+
+
+${CHAOS_PY_SOURCE}
+
+
+def intutic_chaos_begin():
+    # Why the chaos run's plan cannot be used, or "" when it can.
+    plan, error = chaos_decode(os.environ.get("INTUTIC_CHAOS_PLAN", ""))
+    if error:
+        return error
+    if not os.environ.get("INTUTIC_CHAOS_EVENTS"):
+        return "INTUTIC_CHAOS_PLAN is set but INTUTIC_CHAOS_EVENTS is not, so nothing the run does could be reported"
+    return ""
+
+
+def intutic_chaos_call(tool, decision, rule_id, destructive, policy_hit, key=""):
+    # Records one call as the gate decided it, before any fault; returns the
+    # fault to apply to an allowed call as "kind<TAB>reason" (kind deny or
+    # hold), or "". key is the call's digest, which a held call's retry shares.
+    plan, error = chaos_decode(os.environ.get("INTUTIC_CHAOS_PLAN", ""))
+    events = os.environ.get("INTUTIC_CHAOS_EVENTS", "")
+    if error or not events:
+        return ""
+    call = {"tool": tool, "decision": decision, "ruleId": rule_id or None,
+            "destructive": destructive == "1", "policyHit": policy_hit == "1", "key": key}
+    fault = chaos_call(plan, events, call, chaos_now())
+    if fault is None:
+        return ""
+    return fault["kind"] + "\\t" + fault["reason"]
 `;
 /**
  * How old a snapshot may be before a gate reports it as stale.
@@ -513,6 +580,12 @@ intutic_fail_closed() {
   set +eu
   trap - EXIT
   [ -n "\${INTUTIC_WATCHDOG_PID:-}" ] && kill "$INTUTIC_WATCHDOG_PID" 2>/dev/null
+  # A chaos run's record of a call the gate refused, held or crashed on (the
+  # gate body records an allowed one where it ends). It cannot change the
+  # exit status: everything it prints is discarded.
+  if [ "$_intutic_exit_rc" != "0" ] && [ "\${INTUTIC_CHAOS_ACTIVE:-0}" = "1" ] && command -v intutic_chaos_decide >/dev/null 2>&1; then
+    intutic_chaos_decide "\${_intutic_chaos_decision:-deny}" >/dev/null 2>&1
+  fi
   if [ "$_intutic_exit_rc" = "0" ] || [ "$_intutic_exit_rc" = "2" ]; then
     exit "$_intutic_exit_rc"
   fi
@@ -587,6 +660,16 @@ function intuticPhraseRule(source, words) {
   return false;
 }`;
 }
+/**
+ * What an OPAQUE workspace's agent reads of a refusal on workspace policy,
+ * emitted once into every JS-family gate: `intuticShown(snap, reason)` is the
+ * reason, or the generic sentence when the snapshot carries the
+ * `@intervention_mode` record. The audit line always gets the full reason.
+ */
+const JS_OPAQUE_HELPERS = `const INTUTIC_OPAQUE_MESSAGE = ${JSON.stringify(OPAQUE_REFUSAL_MESSAGE)};
+function intuticShown(snap, reason) {
+  return snap && snap.opaque ? INTUTIC_OPAQUE_MESSAGE : reason;
+}`;
 /**
  * The hold tier's JS helpers, emitted once into every JS-family gate.
  *
@@ -598,6 +681,7 @@ function intuticPhraseRule(source, words) {
 function jsHoldHelpers(reviewRequestFile) {
     return `${emitJsActionClassifier()}
 const INTUTIC_REVIEW_REQUEST_FILE = ${JSON.stringify(reviewRequestFile ?? null)};
+${JS_OPAQUE_HELPERS}
 
 // Who may approve a hold, and when the retry passes: the sentence every gate
 // and the MCP proxy print (holdMessages.ts in shared-types).
@@ -654,7 +738,7 @@ function intuticApprovedBypass(workspaceId, sopRuleId, toolNameNormalized, targe
   return null;
 }
 
-function intuticHold(rule, toolName, command, target, toolInput, record, workspaceId, sessionId) {
+function intuticHold(rule, toolName, command, target, toolInput, record, workspaceId, sessionId, opaque) {
   var crypto = require('crypto'), fs = require('fs'), path = require('path');
   // Key material, computed the same way at both ends: the normalised tool
   // name, and sha256 of the normalised command/target pair joined by a NUL so
@@ -700,7 +784,9 @@ function intuticHold(rule, toolName, command, target, toolInput, record, workspa
     try { console.error('[Intutic Guardrail] could not record the hold: ' + (e && e.message ? e.message : e)); } catch (e2) {}
   }
   var reason = rule.reason + ' [' + rule.id + ']';
-  try { console.error('[Intutic Guardrail] HELD: ' + reason + ' ' + intuticHoldHint(holdId)); } catch (e) {}
+  // An OPAQUE workspace's agent reads the generic sentence, not the rule; the
+  // hint stays, since it names the hold, not the policy.
+  try { console.error('[Intutic Guardrail] HELD: ' + (opaque ? INTUTIC_OPAQUE_MESSAGE : reason) + ' ' + intuticHoldHint(holdId)); } catch (e) {}
   try { record('tool_held', toolName, reason); } catch (e) {}
   return { holdId: holdId };
 }`;
@@ -728,6 +814,52 @@ export function emitShellGate(opts) {
 # were previously passed in and dropped on the floor: opts.harness was declared
 # on the option type, supplied by all thirteen writers, and read nowhere.
 
+# ── Agent fault injection (intutic chaos run) ────────────────────────────────
+# Only when INTUTIC_CHAOS_PLAN is set: a chaos experiment's runner sets it, with
+# INTUTIC_CHAOS_EVENTS, in the sandbox the agent runs in, and this gate inherits
+# both. The work is chaos.py in INTUTIC_PY_LIB, the transliteration of
+# chaosGate.ts in @intutic/shared-types, which explains the counter files kept
+# beside the events file. An allowed call is recorded where this body ends,
+# where its fault is applied; a refused, held or crashed one by the exit trap.
+# A fault applies only to an allowed call. Scoped to the bare invocation, like
+# the envelope refusal below.
+INTUTIC_CHAOS_ACTIVE=0
+_intutic_chaos_done=0
+_intutic_chaos_decision=deny
+_intutic_chaos_rule=""
+_intutic_chaos_hit=0
+_intutic_chaos_destructive=0
+# Records this call as decided ($1: allow, deny or hold) and prints the fault
+# to apply to an allowed one, as kind and reason, tab-separated. $2 is the
+# call's digest, which a held call's retry shares.
+intutic_chaos_decide() {
+  [ "$INTUTIC_CHAOS_ACTIVE" = "1" ] && [ "$_intutic_chaos_done" = "0" ] || return 0
+  python3 -c 'import os, sys
+lib = {}
+exec(os.environ.get("INTUTIC_PY_LIB", ""), lib)
+sys.stdout.write(lib["intutic_chaos_call"](*sys.argv[1:]))' "\${TOOL:-unknown}" "$1" "$_intutic_chaos_rule" "$_intutic_chaos_destructive" "$_intutic_chaos_hit" "\${2:-}" || true
+}
+# A rule fired without deciding the call (shadow, warn): its id, if none yet.
+intutic_chaos_note() {
+  [ -n "$_intutic_chaos_rule" ] || _intutic_chaos_rule="$1"
+}
+if [ -z "\${1:-}" ] && [ -n "\${INTUTIC_CHAOS_PLAN:-}" ]; then
+  # A plan that is set but unreadable refuses, as an unreadable payload does:
+  # an experiment run without the faults it asked for reports a resilience it
+  # never measured.
+  _intutic_chaos_err="$(python3 -c 'import os, sys
+lib = {}
+exec(os.environ.get("INTUTIC_PY_LIB", ""), lib)
+sys.stdout.write(lib["intutic_chaos_begin"]())' 2>/dev/null || echo "INTUTIC_CHAOS_PLAN could not be read")"
+  if [ -n "$_intutic_chaos_err" ]; then
+    _intutic_chaos_err="\${_intutic_chaos_err} — refusing the call rather than running the experiment without the faults it asked for"
+    echo "[Intutic Governance] BLOCKED: \${_intutic_chaos_err}" >&2
+    ${log} "tool_blocked" "\${TOOL:-unknown}" "\${_intutic_chaos_err}" || true
+    exit 2
+  fi
+  INTUTIC_CHAOS_ACTIVE=1
+fi
+
 # Refuse an unreadable envelope before any rule is consulted.
 #
 # Unparseable stdin used to degrade to empty extracted fields, which match no
@@ -794,6 +926,12 @@ INTUTIC_MCP_SEVERITY=""
 INTUTIC_MCP_SERVERS=""
 # The MCP server registry record (base64 JSON, inside the digest).
 INTUTIC_MCP_REGISTRY=""
+# An OPAQUE workspace (the @intervention_mode record): a refusal on workspace
+# policy tells the agent this sentence instead of the rule, and the audit line
+# keeps the rule. Kept on a snapshot that fails its digest: it only ever hides
+# text, never allows a call.
+INTUTIC_OPAQUE=0
+INTUTIC_OPAQUE_MESSAGE=${shq(OPAQUE_REFUSAL_MESSAGE)}
 if [ -f "$INTUTIC_SNAPSHOT_RULES" ]; then
   INTUTIC_SNAPSHOT_STATE="ok"
   while IFS= read -r _line || [ -n "$_line" ]; do
@@ -811,6 +949,7 @@ if [ -f "$INTUTIC_SNAPSHOT_RULES" ]; then
         INTUTIC_MCP_SERVERS="\${_intutic_mcp_rest#*$'\\t'}"
         ;;
       '${MCP_REGISTRY_RECORD_TAG}'$'\\t'*) INTUTIC_MCP_REGISTRY="\${_line#*$'\\t'}" ;;
+      '${INTERVENTION_MODE_RECORD_TAG}'$'\\t''OPAQUE') INTUTIC_OPAQUE=1 ;;
       '#'*|'') : ;;
       *) INTUTIC_DYNAMIC+=("$_line") ;;
     esac
@@ -914,6 +1053,12 @@ intutic_sha256() {
 intutic_json_escape() {
   printf '%s' "$1" | sed -e 's/\\\\/\\\\\\\\/g' -e 's/"/\\\\"/g' | tr -d '\\n\\r\\t'
 }
+# What the agent reads of a refusal on workspace policy, in _intutic_shown: the
+# reason ($1), or in an OPAQUE workspace the generic sentence. The audit line
+# is always written with the full reason.
+intutic_shown() {
+  if [ "$INTUTIC_OPAQUE" = "1" ]; then _intutic_shown="$INTUTIC_OPAQUE_MESSAGE"; else _intutic_shown="$1"; fi
+}
 # Looks for a valid, unexpired, EXACT-match approved bypass. Prints nothing
 # and returns 1 on ANY reason not to bypass: missing file, failed digest or
 # workspace check, no matching line, or an entry whose expiresAt has passed —
@@ -976,7 +1121,8 @@ intutic_hold() {
   # Who may approve, and when the retry passes (holdMessages.ts in shared-types).
   hint=${shq(HOLD_APPROVAL_HINT_TEMPLATE)}
   hint="\${hint//\\{holdId\\}/$hold_id}"
-  echo "[Intutic Guardrail] HELD: \${rreason} [\${rid}] \${hint}" >&2
+  intutic_shown "\${rreason} [\${rid}]"
+  echo "[Intutic Guardrail] HELD: \${_intutic_shown} \${hint}" >&2
   ${log} "tool_held" "\${TOOL:-}" "\${rreason} [\${rid}]" || true
   return 2
 }
@@ -984,24 +1130,20 @@ intutic_hold() {
 # A rule declares which part of the call it matches. \`any\` means command and
 # target — never the tool name, because a pattern like \`\\.claude/settings\\.json\`
 # would otherwise be tested against "Write" and quietly match nothing.
-intutic_apply() {
-  local rec="$1"
+#
+# Whether a rule fires on this call sets _intutic_fires to 1 or 0; the function
+# always returns 0, so it runs under set -e like the rest of the gate. With $2
+# "quiet" it records nothing: a chaos run's destructive check probes rules
+# without deciding by them.
+intutic_rule_fires() {
+  local rec="$1" quiet="\${2:-}"
   local rid rsev rflags rsubj rreason rsrc rargb64 s hit
+  _intutic_fires=0
   # Seven variables over a six- or seven-field record: a v3 line leaves rargb64
   # empty, which is exactly "no argument condition". The base64 column cannot
   # contain a tab, so the last variable never absorbs a separator.
   IFS=$'\\t' read -r rid rsev rflags rsubj rreason rsrc rargb64 <<< "$rec"
   [ -z "$rsrc" ] && return 0
-  # The escape hatch skips the DESTRUCTIVE family only. It is not a way to turn
-  # off a workspace's own BLOCK: SOP rules — those are what the customer asked
-  # for, and one environment variable disarming them would make the switch the
-  # first thing an agent sets. Keyed on the rule-id family, which the snapshot
-  # writer assigns: destructive.* versus sop.*
-  if [ "$INTUTIC_GUARDS_DISABLED" = "1" ]; then
-    case "$rid" in
-      destructive.*) return 0 ;;
-    esac
-  fi
   local _subs=() _ci=
   case "$rflags" in *i*) _ci=i ;; esac
   # A subject the screen below cleared for this case is left out: no pattern
@@ -1082,18 +1224,41 @@ sys.exit(0 if rx.search(sys.argv[2]) else 1)
 ' "$rargb64" "\${TOOL_INPUT_JSON:-}" 2>/dev/null || _intutic_arg_rc=$?
     if [ "$_intutic_arg_rc" = "1" ]; then
       return 0
-    elif [ "$_intutic_arg_rc" != "0" ]; then
+    elif [ "$_intutic_arg_rc" != "0" ] && [ -z "$quiet" ]; then
       ${log} "rule_downgraded" "\${TOOL:-}" "argPattern for \${rid} did not compile in python re — rule enforced name-only" || true
     fi
   fi
+  _intutic_fires=1
+}
+
+intutic_apply() {
+  local rec="$1"
+  local rid rsev rflags rsubj rreason rsrc rargb64
+  IFS=$'\\t' read -r rid rsev rflags rsubj rreason rsrc rargb64 <<< "$rec"
+  [ -z "$rsrc" ] && return 0
+  # The escape hatch skips the DESTRUCTIVE family only. It is not a way to turn
+  # off a workspace's own BLOCK: SOP rules — those are what the customer asked
+  # for, and one environment variable disarming them would make the switch the
+  # first thing an agent sets. Keyed on the rule-id family, which the snapshot
+  # writer assigns: destructive.* versus sop.*
+  if [ "$INTUTIC_GUARDS_DISABLED" = "1" ]; then
+    case "$rid" in
+      destructive.*) return 0 ;;
+    esac
+  fi
+  intutic_rule_fires "$rec"
+  [ "$_intutic_fires" = "1" ] || return 0
   if [ "$rsev" = "shadow" ]; then
+    intutic_chaos_note "$rid"
     ${log} "tool_would_block" "\${TOOL:-}" "\${rreason} [\${rid}]" || true
     return 0
   fi
   if [ "$rsev" = "hold" ]; then
     # Not a permanent denial: the action is legitimate, someone asked to see
     # it first. A bypass they approved lets this exact call through once.
+    _intutic_chaos_rule="$rid"; _intutic_chaos_hit=1
     if intutic_hold "$rid" "$rreason"; then return 0; fi
+    _intutic_chaos_decision=hold
     exit 2
   fi
   if [ "$rsev" = "warn" ]; then
@@ -1109,13 +1274,16 @@ sys.exit(0 if rx.search(sys.argv[2]) else 1)
     # telemetry.
     _intutic_verb="\${INTUTIC_NCOMMAND# }"
     _intutic_verb="\${_intutic_verb%% *}"
+    intutic_chaos_note "$rid"
     ${log} "tool_flagged" "\${TOOL:-}" "\${rreason} [\${rid}] verb=\${_intutic_verb}" || true
     return 0
   fi
   # The rule's own reason, not a generic one: hookEvents.resolveSeverity reads
   # this text for "governance-protected" to file the incident CRITICAL.
   local reason="\${rreason} [\${rid}]"
-  echo "[Intutic Governance] BLOCKED: \${reason}" >&2
+  _intutic_chaos_rule="$rid"; _intutic_chaos_hit=1
+  intutic_shown "$reason"
+  echo "[Intutic Governance] BLOCKED: \${_intutic_shown}" >&2
   ${log} "tool_blocked" "\${TOOL:-}" "\${reason}"
   exit 2
 }
@@ -1165,6 +1333,19 @@ intutic_unscreened() {
   [ "\${!v:-}" != "1" ]
 }
 
+# A chaos run's no_destructive_attempt probe: whether a destructive.* rule
+# matches this call, whether or not it decides it, the escape hatch included.
+if [ "$INTUTIC_CHAOS_ACTIVE" = "1" ] && [ \${#INTUTIC_DYNAMIC[@]} -gt 0 ]; then
+  for _rec in "\${INTUTIC_DYNAMIC[@]}"; do
+    case "$_rec" in
+      destructive.*)
+        intutic_rule_fires "$_rec" quiet
+        if [ "$_intutic_fires" = "1" ]; then _intutic_chaos_destructive=1; break; fi
+        ;;
+    esac
+  done
+fi
+
 for _rec in "\${INTUTIC_FLOOR[@]}"; do
   intutic_apply "$_rec"
 done
@@ -1196,6 +1377,7 @@ sys.stdout.write(lib["intutic_mcp_unverified"](sys.argv[1]))' "\${TOOL:-}" 2>/de
         _intutic_unv_rid="policy_snapshot"
         _intutic_unv_reason="POLICY_SNAPSHOT_UNVERIFIED — the policy snapshot failed its integrity check and admits no MCP server"
       fi
+      _intutic_chaos_rule="$_intutic_unv_rid"; _intutic_chaos_hit=1
       echo "[Intutic Governance] BLOCKED: \${_intutic_unv_reason} [\${_intutic_unv_rid}]" >&2
       ${log} "tool_blocked" "\${TOOL:-}" "\${_intutic_unv_reason} [\${_intutic_unv_rid}]"
       exit 2
@@ -1219,7 +1401,9 @@ exec(os.environ.get("INTUTIC_PY_LIB", ""), lib)
 sys.stdout.write(lib["intutic_mcp_registry"](sys.argv[1], sys.argv[2]))' "$INTUTIC_MCP_REGISTRY" "\${TOOL:-}" 2>/dev/null || true)"
       if [ -n "$_intutic_reg" ]; then
         IFS=$'\\t' read -r _ _intutic_reg_rid _intutic_reg_reason <<< "$_intutic_reg"
-        echo "[Intutic Governance] BLOCKED: \${_intutic_reg_reason} [\${_intutic_reg_rid}]" >&2
+        _intutic_chaos_rule="$_intutic_reg_rid"; _intutic_chaos_hit=1
+        intutic_shown "\${_intutic_reg_reason} [\${_intutic_reg_rid}]"
+        echo "[Intutic Governance] BLOCKED: \${_intutic_shown}" >&2
         ${log} "tool_blocked" "\${TOOL:-}" "\${_intutic_reg_reason} [\${_intutic_reg_rid}]"
         exit 2
       fi
@@ -1246,9 +1430,12 @@ case "\${TOOL:-}" in
         *)
           _intutic_mcp_reason="MCP server \\"$_intutic_mcp_server\\" is not on the MCP server allowlist for this workspace [mcp_allowlist]"
           if [ "$INTUTIC_MCP_SEVERITY" = "shadow" ]; then
+            intutic_chaos_note mcp_allowlist
             ${log} "tool_would_block" "\${TOOL:-}" "$_intutic_mcp_reason" || true
           else
-            echo "[Intutic Governance] BLOCKED: $_intutic_mcp_reason" >&2
+            _intutic_chaos_rule=mcp_allowlist; _intutic_chaos_hit=1
+            intutic_shown "$_intutic_mcp_reason"
+            echo "[Intutic Governance] BLOCKED: \${_intutic_shown}" >&2
             ${log} "tool_blocked" "\${TOOL:-}" "$_intutic_mcp_reason"
             exit 2
           fi
@@ -1257,6 +1444,27 @@ case "\${TOOL:-}" in
     fi
     ;;
 esac
+
+# ── Agent fault injection: the call is allowed ───────────────────────────────
+# Recorded as allowed, then the fault that is due, if any. A permission delay
+# never waits here: the call is held, and its identical retry (the same key an
+# approval hold uses) passes, or is denied, once the delay has passed.
+if [ "$INTUTIC_CHAOS_ACTIVE" = "1" ]; then
+  _intutic_chaos_key="$( { printf '%s' "$INTUTIC_NTOOL"; printf '\\0'; printf '%s' "$INTUTIC_NCOMMAND"; printf '\\0'; printf '%s' "$INTUTIC_NTARGET"; } | intutic_sha256 )"
+  _intutic_fault="$(intutic_chaos_decide allow "$_intutic_chaos_key")"
+  _intutic_chaos_done=1
+  if [ -n "$_intutic_fault" ]; then
+    _intutic_fault_kind="\${_intutic_fault%%$'\\t'*}"
+    _intutic_fault_reason="\${_intutic_fault#*$'\\t'}"
+    # The fault's own text, carrying the plan's canary: what the agent reads.
+    if [ "$_intutic_fault_kind" = "hold" ]; then
+      echo "[Intutic Governance] HELD: \${_intutic_fault_reason}" >&2
+    else
+      echo "$_intutic_fault_reason" >&2
+    fi
+    exit 2
+  fi
+fi
 # ── end Intutic gate body ────────────────────────────────────────────────────
 `;
 }
@@ -1275,8 +1483,10 @@ const JS_SNAPSHOT_LOADER = `function intuticLoadSnapshot(INTUTIC_WORKSPACE_ID) {
     path.join(os.homedir(), '.intutic', 'hooks', 'policy-snapshot.rules');
   // mcpAllowlist and mcpRegistry stay null without their records: the
   // workspace set no allowlist and made no registry decision.
+  // opaque: an OPAQUE workspace (the @intervention_mode record). Kept on a
+  // snapshot that fails its digest: it only ever hides text, never allows.
   const out = { rules: [], digest: 'none', state: 'absent', workspaceId: '', generatedAt: '', ageDays: 0,
-    mcpAllowlist: null, mcpRegistry: null };
+    mcpAllowlist: null, mcpRegistry: null, opaque: false };
   let text;
   try { text = fs.readFileSync(p, 'utf8'); } catch (e) { return out; }
   out.state = 'ok';
@@ -1284,6 +1494,7 @@ const JS_SNAPSHOT_LOADER = `function intuticLoadSnapshot(INTUTIC_WORKSPACE_ID) {
     if (line.startsWith('#digest ')) { out.digest = line.slice(8).trim(); continue; }
     if (line.startsWith('#workspace ')) { out.workspaceId = line.slice(11).trim(); continue; }
     if (line.startsWith('#generated ')) { out.generatedAt = line.slice(11).trim(); continue; }
+    if (line === '${INTERVENTION_MODE_RECORD_TAG}\\tOPAQUE') { out.opaque = true; continue; }
     if (line.startsWith('${MCP_ALLOWLIST_RECORD_TAG}\\t')) {
       // The MCP server allowlist: tag, severity and comma-joined servers, a
       // data line inside the digest. Any severity but shadow refuses.
@@ -1379,6 +1590,92 @@ const JS_SNAPSHOT_LOADER = `function intuticLoadSnapshot(INTUTIC_WORKSPACE_ID) {
   }
   return out;
 }`;
+/**
+ * A chaos run's side of the JS gates, defined once: the plan, this call's
+ * record, and the fault to apply to an allowed call.
+ *
+ * `intuticChaosBegin` starts a call's record in `intuticGate`; rules that
+ * fire without deciding note themselves (`intuticChaosNote`); every refusal
+ * and the allow at the end report the decision (`intuticChaosDecide`), which
+ * returns the fault due. Nothing here throws: a fault the gate cannot inject
+ * or report is said on stderr, and the call is decided as governance decided
+ * it.
+ */
+const JS_CHAOS_HELPERS = `// ── Agent fault injection (intutic chaos run) ───────────────────────────────
+// Only when INTUTIC_CHAOS_PLAN is set: a chaos experiment's runner sets it,
+// with INTUTIC_CHAOS_EVENTS, in the sandbox the agent runs in, and this gate
+// inherits both. Emitted from @intutic/shared-types chaosGate.ts, which
+// explains the counter files kept beside the events file. A fault applies only
+// to a call this gate allowed: it never turns a refusal or a hold into an allow.
+${CHAOS_GATE_JS_SOURCE}
+
+var _intuticChaosState = null;
+var _intuticChaosCall = null;
+
+/** The plan, read once per process: { plan, events, error }. */
+function intuticChaos() {
+  if (_intuticChaosState) return _intuticChaosState;
+  var raw = process.env.INTUTIC_CHAOS_PLAN || '', events = process.env.INTUTIC_CHAOS_EVENTS || '';
+  var s = { plan: null, events: events, error: null };
+  if (raw) {
+    var d = chaosGateDecode(raw);
+    if (d.error) s.error = d.error;
+    else if (!events) s.error = 'INTUTIC_CHAOS_PLAN is set but INTUTIC_CHAOS_EVENTS is not, so nothing the run does could be reported';
+    else s.plan = d.plan;
+  }
+  _intuticChaosState = s;
+  return s;
+}
+
+/** Starts this call's record, unless the last gate run said more of the same call follows. */
+function intuticChaosBegin(toolName) {
+  if (_intuticChaosCall && _intuticChaosCall.more) { _intuticChaosCall.more = false; return; }
+  _intuticChaosCall = { tool: String(toolName == null ? '' : toolName), ruleId: null, destructive: false, policyHit: false, more: false };
+}
+
+/** A rule fired on this call without deciding it (shadow, warn, an approved bypass). */
+function intuticChaosNote(ruleId, policyHit) {
+  var c = _intuticChaosCall;
+  if (!c) return;
+  if (ruleId && !c.ruleId) c.ruleId = ruleId;
+  if (policyHit) c.policyHit = true;
+}
+
+/**
+ * Reports this call as the gate decided it, before any fault (allow, deny or
+ * hold), and returns the fault to apply to an allowed call, or null. key is
+ * the call's digest (intuticChaosKey), which a held call's retry shares.
+ */
+function intuticChaosDecide(toolName, decision, ruleId, policyHit, key) {
+  var c = _intuticChaosCall;
+  _intuticChaosCall = null;
+  try {
+    var s = intuticChaos();
+    if (!s.plan) return null;
+    return chaosGateCall(require('fs'), s.plan, s.events, {
+      tool: c ? c.tool : String(toolName == null ? '' : toolName),
+      decision: decision,
+      ruleId: ruleId || (c ? c.ruleId : null),
+      destructive: !!(c && c.destructive),
+      policyHit: !!policyHit || !!(c && c.policyHit),
+      key: key || '',
+    }, new Date().toISOString());
+  } catch (e) {
+    try { console.error('[Intutic Governance] chaos: ' + String((e && e.message) || e)); } catch (e2) {}
+    return null;
+  }
+}
+
+/**
+ * A call's digest, as an approval hold keys it: sha256 of the normalised tool,
+ * command and target, NUL-separated. A held call's identical retry has the
+ * same one.
+ */
+function intuticChaosKey(toolName, command, target) {
+  return require('crypto').createHash('sha256')
+    .update(intuticNormalise(toolName) + '\\u0000' + intuticNormalise(command) + '\\u0000' + intuticNormalise(target))
+    .digest('hex');
+}`;
 /**
  * The JavaScript gate body.
  *
@@ -1395,13 +1692,19 @@ export function emitJsGate(opts) {
      * `code` and `ruleId` are JavaScript expressions: a JSON decision carries
      * them ({@link HOOK_REFUSAL_CODES}), and `extra` adds fields such as `holdId`.
      */
-    const refuseWith = (code, ruleId, extra = '') => {
-        const fields = `code: ${code}, ruleId: ${ruleId}${extra ? `, ${extra}` : ''}`;
+    const refuseWith = (code, ruleId, extra = '', tool = 'toolName', shownRuleId = ruleId) => {
+        // The decision names shownRuleId: the deciding rule, or null where an
+        // OPAQUE workspace hides it. A chaos run's record keeps the rule.
+        const fields = `code: ${code}, ruleId: ${shownRuleId}${extra ? `, ${extra}` : ''}`;
+        // A chaos run's record of the refusal, first: every contract below ends
+        // the call. A refusal a rule decided is a policy hit.
+        const chaos = `      intuticChaosDecide(${tool}, '${code === "'HELD'" ? 'hold' : 'deny'}', ${ruleId}, ${ruleId} != null);\n`;
         if (opts.contract === 'stdout-decision-deny' && opts.documentedFieldsOnly) {
-            return (`      process.stdout.write(JSON.stringify({ decision: 'deny', reason: reason + ' (refusal code ' + ${code} + ')' }) + '\\n');\n` +
+            return (chaos +
+                `      process.stdout.write(JSON.stringify({ decision: 'deny', reason: reason + ' (refusal code ' + ${code} + ')' }) + '\\n');\n` +
                 `      process.exit(0);`);
         }
-        return opts.contract === 'stdout-cancel'
+        return chaos + (opts.contract === 'stdout-cancel'
             // Cline shows a cancel's `errorMessage`; it has no `reason` field.
             ? `      process.stdout.write(JSON.stringify({ cancel: true, errorMessage: reason, ${fields} }) + '\\n');\n` +
                 `      process.exit(0);`
@@ -1412,8 +1715,27 @@ export function emitJsGate(opts) {
                     // The envelope guard's reason already carries the prefix; a rule's
                     // reason does not. One message shape either way.
                     ? `      throw new Error(String(reason).indexOf('[Intutic Governance]') === 0 ? String(reason) : '[Intutic Governance] BLOCKED: ' + reason);`
-                    : `      process.exit(2);`;
+                    : `      process.exit(2);`);
     };
+    /**
+     * A fault a chaos run injects into an allowed call, for a `reason` in scope:
+     * the fault's own text with the plan's canary, through this harness's
+     * contract. Not a refusal by governance, so a JSON decision carries
+     * `code: null`, or `HELD` for a call a permission fault holds (whose
+     * reason already starts `[Intutic Governance] HELD:`, as a hold's does);
+     * the in-process contracts prefix a refusal's text so the host's wrapper
+     * passes it on as it is rather than as a gate fault.
+     */
+    const refuseFault = (code) => `      try { console.error(reason); } catch (e) {}\n` +
+        (opts.contract === 'stdout-cancel'
+            ? `      process.stdout.write(JSON.stringify({ cancel: true, errorMessage: reason, code: ${code}, ruleId: null }) + '\\n');\n` +
+                `      process.exit(0);`
+            : opts.contract === 'stdout-decision-deny'
+                ? `      process.stdout.write(JSON.stringify(${opts.documentedFieldsOnly ? `{ decision: 'deny', reason: reason${code === 'null' ? '' : ` + ' (refusal code HELD)'`} }` : `{ decision: 'deny', reason: reason, code: ${code}, ruleId: null }`}) + '\\n');\n` +
+                    `      process.exit(0);`
+                : opts.contract === 'throw'
+                    ? `      throw new Error(${code === 'null' ? `'[Intutic Governance] ' + reason` : 'reason'});`
+                    : `      process.exit(2);`);
     return `
 // ── Intutic gate body v${GATE_VERSION} — harness: ${opts.harness} ────────────
 // Generated by harness/gateBody.ts. Do not edit here; every harness regenerates.
@@ -1432,6 +1754,8 @@ ${JS_SNAPSHOT_LOADER}
 
 ${jsHoldHelpers(opts.reviewRequestFile)}
 
+${JS_CHAOS_HELPERS}
+
 /**
  * Refuses a parsed payload that carries no recognisable tool-call envelope.
  *
@@ -1462,7 +1786,7 @@ function intuticGuardEnvelope(ctx, keys, record) {
     'refusing rather than allowing a call the gate cannot read.';
   try { console.error(reason); } catch (e) {}
   try { record('tool_blocked', 'unknown', reason); } catch (e) {}
-${refuseWith("'UNREADABLE_CALL'", 'null')}
+${refuseWith("'UNREADABLE_CALL'", 'null', '', "'unknown'")}
 }
 
 /**
@@ -1499,7 +1823,18 @@ ${MCP_SNAPSHOT_UNVERIFIED_JS_SOURCE}
  * matchSopRule and the intutic-clawde gate port pin — and the gate serializes
  * it itself so no writer can hand it a differently-shaped string.
  */
-function intuticGate(toolName, target, command, record, workspaceId, toolInput, sessionId) {
+function intuticGate(toolName, target, command, record, workspaceId, toolInput, sessionId, more) {
+  // A chaos run's record of this call (see intuticChaosDecide). A plan that is
+  // set but unreadable refuses, as an unreadable payload does: an experiment
+  // run without the faults it asked for reports a resilience it never measured.
+  intuticChaosBegin(toolName);
+  var _chaos = intuticChaos();
+  if (_chaos.error) {
+    var reason = _chaos.error + ' — refusing the call rather than running the experiment without the faults it asked for';
+    try { console.error('[Intutic Governance] BLOCKED: ' + reason); } catch (e) {}
+    try { record('tool_blocked', toolName, reason); } catch (e) {}
+${refuseWith("'GATE_CRASHED'", 'null')}
+  }
   // Too large to evaluate inside the hook timeout (gateLimits.ts in
   // @intutic/shared-types): refused before any rule reads the call.
   var _commandBytes = Buffer.byteLength(String(command == null ? '' : command), 'utf8');
@@ -1530,7 +1865,7 @@ ${opts.contract === 'throw'
     return _intuticGateRules(toolName, target, command, record, workspaceId, toolInput, sessionId);
   };
   try {
-    return require('vm').runInThisContext('__intuticGateRules()', { timeout: _deadlineMs });
+    require('vm').runInThisContext('__intuticGateRules()', { timeout: _deadlineMs });
   } catch (err) {
     if (!err || err.code !== 'ERR_SCRIPT_EXECUTION_TIMEOUT') throw err;
     var reason = 'GATE_DEADLINE — the gate did not finish evaluating this call within ${deadlineMs / 1000} s, and refuses it rather than let the hook timeout allow it';
@@ -1538,6 +1873,53 @@ ${opts.contract === 'throw'
     try { record('tool_blocked', toolName, reason); } catch (e) {}
 ${refuseWith("'GATE_DEADLINE'", 'null')}
   }
+
+  // The call is allowed. A writer that runs this once per target of one call
+  // (OpenClaw's apply_patch) passes more for all but the last, so the
+  // call is reported, and faulted, once.
+  if (more) {
+    if (_intuticChaosCall) _intuticChaosCall.more = true;
+    return;
+  }
+  var _fault = intuticChaosDecide(toolName, 'allow', null, false, intuticChaos().plan ? intuticChaosKey(toolName, command, target) : '');
+  if (!_fault) return;
+  // A permission delay never waits here: the call is held, and its identical
+  // retry passes, or is denied, once the delay has passed.
+  if (_fault.kind === 'hold') {
+    var reason = '[Intutic Governance] HELD: ' + _fault.reason;
+${refuseFault("'HELD'")}
+  }
+  var reason = _fault.reason;
+${refuseFault('null')}
+}
+
+/**
+ * The subjects of this call a rule matches, before its argument condition:
+ * for a phrase rule, the command when its phrases are in it. The context c
+ * holds the call's subject strings, and the phrase matcher's words once
+ * computed.
+ */
+function intuticRuleSubjects(rule, c) {
+  // A phrase rule's source is |-separated phrases matched as words against
+  // the raw command — never as a regex, which backtracks on crafted input.
+  if (rule.subject === 'phrase') {
+    if (c.words === null) c.words = phraseText(c.command);
+    return intuticPhraseRule(rule.re.source, c.words) ? [c.nCommand] : [];
+  }
+  // Each field is tested separately rather than concatenated — joining them
+  // lets a pattern match across the seam between two innocuous values.
+  const subjects =
+    rule.subject === 'tool' ? [c.nTool]
+    : rule.subject === 'command' ? [c.nCommand]
+    : rule.subject === 'target' ? [c.nTarget]
+    // The serialized tool input, un-normalised: a content rule (the
+    // secrets.* floor) matches the bytes a Write would put on disk. The
+    // same string the WHERE argPattern machinery tests, so the two content
+    // subjects cannot drift.
+    : rule.subject === 'content' ? [c.toolInputJson]
+    : rule.subject === 'action' ? [c.nActions]
+    : [c.nCommand, c.nTarget];
+  return subjects.filter(function (subject) { return intuticRuleMatches(rule, subject); });
 }
 
 function _intuticGateRules(toolName, target, command, record, workspaceId, toolInput, sessionId) {
@@ -1587,6 +1969,11 @@ function _intuticGateRules(toolName, target, command, record, workspaceId, toolI
           : 'Policy snapshot is ' + snap.ageDays + ' days old and still enforced';
     try { record('snapshot_' + snap.state, toolName, _msg); } catch (e) {}
   }
+  // A chaos run's no_destructive_attempt probe reads every destructive.* rule,
+  // the ones the escape hatch skips below included.
+  const _chaosDestructive = intuticChaos().plan
+    ? snap.rules.filter(function (r) { return r.id.indexOf('destructive.') === 0; })
+    : [];
   if (disabled) snap.rules = snap.rules.filter(function (r) { return r.id.indexOf('destructive.') !== 0; });
   // JSON.stringify(tool_input) — no replacer, no spacing — matching matchSopRule.
   // stringify(undefined) is undefined, hence the fallbacks; a throw cannot
@@ -1600,31 +1987,18 @@ function _intuticGateRules(toolName, target, command, record, workspaceId, toolI
   // The space-padded action tokens the command classifies to, for \`action\`
   // subject rules (" action:deploy ").
   const nActions = intuticActions(toolName, command);
-  var words = null;
+  const ctx = { command: command, words: null, nCommand: nCommand, nTarget: nTarget, nTool: nTool,
+    toolInputJson: toolInputJson, nActions: nActions };
+  for (const rule of _chaosDestructive) {
+    // A rule whose argument condition did not compile fires name-only, as below.
+    if (intuticRuleSubjects(rule, ctx).length > 0 && (rule.argDowngraded || !rule.argRe || rule.argRe.test(toolInputJson))) {
+      if (_intuticChaosCall) _intuticChaosCall.destructive = true;
+      break;
+    }
+  }
   const rules = INTUTIC_FLOOR.concat(snap.rules);
   for (const rule of rules) {
-    // A phrase rule's source is |-separated phrases matched as words against
-    // the raw command — never as a regex, which backtracks on crafted input.
-    if (rule.subject === 'phrase') {
-      if (words === null) words = phraseText(command);
-      if (!intuticPhraseRule(rule.re.source, words)) continue;
-    }
-    // Each field is tested separately rather than concatenated — joining them
-    // lets a pattern match across the seam between two innocuous values.
-    const subjects =
-      rule.subject === 'phrase' ? [nCommand]
-      : rule.subject === 'tool' ? [nTool]
-      : rule.subject === 'command' ? [nCommand]
-      : rule.subject === 'target' ? [nTarget]
-      // The serialized tool input, un-normalised: a content rule (the
-      // secrets.* floor) matches the bytes a Write would put on disk. The
-      // same string the WHERE argPattern machinery tests, so the two content
-      // subjects cannot drift.
-      : rule.subject === 'content' ? [toolInputJson]
-      : rule.subject === 'action' ? [nActions]
-      : [nCommand, nTarget];
-    for (const subject of subjects) {
-      if (rule.subject !== 'phrase' && !intuticRuleMatches(rule, subject)) continue;
+    for (const subject of intuticRuleSubjects(rule, ctx)) {
       // The argument condition of a WHERE rule: the tool-name half has
       // matched, and the rule fires only if the argPattern also matches the
       // serialized tool input. A pattern that failed to compile at load time
@@ -1641,6 +2015,7 @@ function _intuticGateRules(toolName, target, command, record, workspaceId, toolI
       }
       if (rule.severity === 'shadow') {
         // Certain rule, deliberately not acted on. Counted apart from warn.
+        intuticChaosNote(rule.id, false);
         try { record('tool_would_block', toolName, rule.reason + ' [' + rule.id + ']'); } catch (e) {}
         continue;
       }
@@ -1648,16 +2023,17 @@ function _intuticGateRules(toolName, target, command, record, workspaceId, toolI
         // Not a permanent denial: the action is legitimate, someone asked to
         // see it first. An approved bypass lets this exact call through once;
         // otherwise the hold is recorded for review and the call refused.
-        const held = intuticHold(rule, toolName, command, target, toolInput, record, workspaceId, sessionId);
-        if (held.bypassed) continue;
-        const reason = '[Intutic Governance] HELD: ' + rule.reason + ' [' + rule.id + '] ' + intuticHoldHint(held.holdId);
-${refuseWith("'HELD'", 'rule.id', 'holdId: held.holdId')}
+        const held = intuticHold(rule, toolName, command, target, toolInput, record, workspaceId, sessionId, snap.opaque);
+        if (held.bypassed) { intuticChaosNote(rule.id, true); continue; }
+        const reason = '[Intutic Governance] HELD: ' + intuticShown(snap, rule.reason + ' [' + rule.id + ']') + ' ' + intuticHoldHint(held.holdId);
+${refuseWith("'HELD'", 'rule.id', 'holdId: held.holdId', 'toolName', '(snap.opaque ? null : rule.id)')}
       }
       if (rule.severity === 'warn') {
         // Advisory tier — allowed, recorded with the rule id and the command's
         // first token. The verb is what makes a flag triageable as true or false
         // positive; without it the promotion rule this tier exists to serve is
         // not measurable. Arguments and paths stay out — that is DLP's job.
+        intuticChaosNote(rule.id, false);
         try {
           record('tool_flagged', toolName,
             rule.reason + ' [' + rule.id + '] verb=' + nCommand.trim().split(' ')[0]);
@@ -1670,10 +2046,11 @@ ${refuseWith("'HELD'", 'rule.id', 'holdId: held.holdId')}
       }
       // The rule's own reason, not a generic one: hookEvents.resolveSeverity
       // reads this text for "governance-protected" to file it CRITICAL.
-      const reason = rule.reason + ' [' + rule.id + ']';
+      const _full = rule.reason + ' [' + rule.id + ']';
+      const reason = intuticShown(snap, _full);
       try { console.error('[Intutic Governance] BLOCKED: ' + reason); } catch (e) {}
-      try { record('tool_blocked', toolName, reason); } catch (e) {}
-${refuseWith('intuticRuleCode(rule)', 'rule.id')}
+      try { record('tool_blocked', toolName, _full); } catch (e) {}
+${refuseWith('intuticRuleCode(rule)', 'rule.id', '', 'toolName', '(snap.opaque ? null : rule.id)')}
     }
   }
 
@@ -1701,10 +2078,11 @@ ${refuseWith('_unv.code', '_unv.ruleId')}
     var _regSep = _regRest.indexOf('__');
     var _reg = _regSep > 0 ? evaluateMcpRegistry(snap.mcpRegistry, _regRest.slice(0, _regSep), _regRest.slice(_regSep + 2)) : null;
     if (_reg) {
-      var reason = _reg.reason + ' [' + _reg.ruleId + ']';
+      var _regFull = _reg.reason + ' [' + _reg.ruleId + ']';
+      var reason = intuticShown(snap, _regFull);
       try { console.error('[Intutic Governance] BLOCKED: ' + reason); } catch (e) {}
-      try { record('tool_blocked', toolName, reason); } catch (e) {}
-${refuseWith('_reg.code', '_reg.ruleId')}
+      try { record('tool_blocked', toolName, _regFull); } catch (e) {}
+${refuseWith('_reg.code', '_reg.ruleId', '', 'toolName', '(snap.opaque ? null : _reg.ruleId)')}
     }
   }
 
@@ -1722,11 +2100,13 @@ ${refuseWith('_reg.code', '_reg.ruleId')}
       // and the throw contract would hit a ReferenceError here.
       var reason = _mcp.reason + ' [' + _mcp.ruleId + ']';
       if (snap.mcpAllowlist.severity === 'shadow') {
+        intuticChaosNote(_mcp.ruleId, false);
         try { record('tool_would_block', toolName, reason); } catch (e) {}
       } else {
-        try { console.error('[Intutic Governance] BLOCKED: ' + reason); } catch (e) {}
         try { record('tool_blocked', toolName, reason); } catch (e) {}
-${refuseWith('_mcp.code', '_mcp.ruleId')}
+        reason = intuticShown(snap, reason);
+        try { console.error('[Intutic Governance] BLOCKED: ' + reason); } catch (e) {}
+${refuseWith('_mcp.code', '_mcp.ruleId', '', 'toolName', '(snap.opaque ? null : _mcp.ruleId)')}
       }
     }
   }
@@ -2147,7 +2527,11 @@ def _intutic_rule_search(src, subject, flags_re, seq):
     return re.search(src, subject, flags_re) is not None
 
 
-_state = {"digest": "", "workspace": ""}
+# The sentence an OPAQUE workspace's refusal shows in place of the rule
+# (OPAQUE_REFUSAL_MESSAGE in @intutic/shared-types).
+_INTUTIC_OPAQUE_MESSAGE = ${JSON.stringify(OPAQUE_REFUSAL_MESSAGE)}
+
+_state = {"digest": "", "workspace": "", "opaque": False}
 
 
 def _intutic_snapshot_rules():
@@ -2162,6 +2546,8 @@ def _intutic_snapshot_rules():
         os.path.expanduser("~"), ".intutic", "hooks", "policy-snapshot.rules"
     )
     out = []
+    # Read afresh each time: the filter outlives a change of mode.
+    _state["opaque"] = False
     try:
         with open(p, "r", encoding="utf-8") as fh:
             for line in fh:
@@ -2175,6 +2561,11 @@ def _intutic_snapshot_rules():
                 if line.startswith("#workspace "):
                     _state["workspace"] = line[11:].strip()
                     continue
+                # An OPAQUE workspace: a refusal shows _INTUTIC_OPAQUE_MESSAGE.
+                # Kept on a snapshot that fails its digest; it only hides text.
+                if line == "${INTERVENTION_MODE_RECORD_TAG}\\tOPAQUE":
+                    _state["opaque"] = True
+                    continue
                 if not line or line.startswith("#"):
                     continue
                 f = line.split("\\t")
@@ -2318,6 +2709,8 @@ ${PHRASES_JS_SOURCE}
 
 ${JS_SNAPSHOT_LOADER}
 
+${JS_OPAQUE_HELPERS}
+
 // The refusal of an MCP call on an unverified snapshot (mcpRegistryRecord.ts).
 ${MCP_SNAPSHOT_UNVERIFIED_JS_SOURCE}
 
@@ -2465,9 +2858,11 @@ function intuticGateWorkflow(workflow, record, workspaceId) {
         // The rule's own reason, not a generic one: hookEvents.resolveSeverity
         // reads this text for "governance-protected" to file it CRITICAL.
         const reason = rule.reason + ' [' + rule.id + '] (node "' + nodeName + '", type ' + nodeType + ')';
-        try { console.error('[Intutic Governance] BLOCKED: ' + reason); } catch (e) {}
+        // An OPAQUE workspace is told which node, not which rule.
+        const shown = snap.opaque ? INTUTIC_OPAQUE_MESSAGE + ' (node "' + nodeName + '")' : reason;
+        try { console.error('[Intutic Governance] BLOCKED: ' + shown); } catch (e) {}
         try { record('tool_blocked', 'n8n:' + nodeName, reason); } catch (e) {}
-        throw new Error('[Intutic Governance] BLOCKED: ' + reason);
+        throw new Error('[Intutic Governance] BLOCKED: ' + shown);
       }
     }
   }