@lannguyensi/harness 0.43.0 → 0.45.0

package/dist/runtime/intercept.js

@@ -5,13 +5,16 @@
 // the decisions and the Claude Code deny-JSON (or null when all allow).
 // Side effects (stdin, stdout, ledger I/O) live in the thin CLI entrypoint
 // that wraps this.
+import * as fs from "node:fs";
+import * as path from "node:path";
 import { evaluateExtract, evaluateRequires, parseDurationSeconds, substituteTemplate, } from "../policies/index.js";
 import { renderProducers } from "../policies/producers.js";
 import { buildActionEnvelope } from "./action-envelope.js";
 import { renderAgentFacing } from "./agent-facing.js";
-import { normalizeCommand } from "./command-normalize.js";
+import { normalizeCommand, normalizeCommandAmpAware, normalizeCommandQuoteAware, segmentViewOf, } from "./command-normalize.js";
 import { resolveEnvironment, } from "./environment-resolver.js";
-import { POLICY_DECISION_TYPE } from "./ledger-record.js";
+import { resolveGitContext } from "./git-context.js";
+import { POLICY_DECISION_TYPE } from "../io/ledger-record.js";
 import { classifyRisk } from "./risk-classifier.js";
 import { resolveSessionId } from "./session-id.js";
 import { expandToolNameAliases, extractShellCommand, } from "./tool-name-aliases.js";
@@ -57,8 +60,22 @@ function enrichEnvelope(manifest, event, riskContext, now) {
  * tests), which fall back to computing it lazily right here — correct
  * either way, since `normalizeCommand` is a pure function of the
  * command string alone.
+ *
+ * `ampNormalizedCommandThunk` (task aabbad63) is the SAME
+ * resolved-by-the-wrapper pattern for the ampersand-aware SECOND
+ * normalisation pass, but threaded as a memoised THUNK rather than a
+ * precomputed value — see `InterceptOptions.ampNormalizedCommandThunk`
+ * for why laziness matters here specifically. Omitted callers fall back
+ * to calling `normalizeCommandAmpAware` directly, same shape as the
+ * `precomputedNormalizedCommand` fallback above.
+ *
+ * `quoteNormalizedCommandThunk` (task cf3dff51) is the SAME thunk pattern
+ * again, for the quote-aware THIRD normalisation pass — see
+ * `InterceptOptions.quoteNormalizedCommandThunk`. Omitted callers fall
+ * back to calling `normalizeCommandQuoteAware` directly, same shape as
+ * the two fallbacks above.
  */
-export function policyMatchesEvent(policy, event, precomputedNormalizedCommand) {
+export function policyMatchesEvent(policy, event, precomputedNormalizedCommand, ampNormalizedCommandThunk, quoteNormalizedCommandThunk) {
     if (policy.trigger.event !== event.hook_event_name)
         return false;
     if (policy.trigger.match !== undefined) {
@@ -80,23 +97,43 @@ export function policyMatchesEvent(policy, event, precomputedNormalizedCommand)
         catch {
             return false;
         }
-        // Raw-OR-normalised (D-003, run 2026-07-27-gate-target-repo-
-        // resolution): test the RAW command first — cheap, and byte-
-        // identical to the pre-fix behaviour — then, only if that fails,
-        // fall back to the NORMALISED command (wrapper prefixes peeled, git
-        // global options dropped, whitespace collapsed). Strictly additive:
-        // a command that matched today keeps matching via the raw test
-        // alone; normalisation can only ADD a match a spelling would
-        // otherwise have missed (env/nice/command wrappers, extra git
-        // global options, doubled whitespace), never remove the raw one.
-        // Replacing the matcher input instead of OR-ing it risks silently
-        // REMOVING an existing match if normalisation ever mangles some
-        // shape — the fail-open direction for a gate — so this stays
-        // additive rather than a substitution.
+        // Raw-OR-normalised-OR-amp-normalised-OR-quote-normalised (D-003, run
+        // 2026-07-27-gate-target-repo-resolution; third arm added task
+        // aabbad63; fourth arm added task cf3dff51): test the RAW command
+        // first — cheap, and byte-identical to the pre-fix behaviour — then,
+        // only if that fails, the primary NORMALISED command (wrapper
+        // prefixes peeled, git global options dropped, whitespace collapsed,
+        // BOUNDARY_RE segmentation) — then, only if THAT also fails, the
+        // ampersand-aware second pass (AMP_BOUNDARY_RE segmentation, closing
+        // the bare-`&` family BOUNDARY_RE cannot see: `A=x&env -C /tmp git
+        // status`, `echo hi & nice git status`) — then, only if THAT also
+        // fails, the quote-aware third pass (BOUNDARY_RE's own alphabet, but
+        // quote-tracking, closing a shell-boundary character sitting INSIDE a
+        // quoted assignment value: `VAR='a; b' git push origin master`).
+        // Strictly additive at every step: a command that matched today keeps
+        // matching via the raw test alone; the primary normalised form can
+        // only ADD a match (env/nice/command wrappers, extra git global
+        // options, doubled whitespace); the amp-aware form can only add a
+        // FURTHER match on top of those two; the quote-aware form can only
+        // add a FOURTH match on top of all three, never remove one any of the
+        // others already found. Replacing the matcher input instead of OR-ing
+        // it in risks silently REMOVING an existing match if some pass ever
+        // mangles a shape — the fail-open direction for a gate — so this
+        // stays additive rather than a substitution at every arm.
         if (!re.test(command)) {
             const { normalized } = precomputedNormalizedCommand ?? normalizeCommand(command);
-            if (!re.test(normalized))
-                return false;
+            if (!re.test(normalized)) {
+                const amp = ampNormalizedCommandThunk
+                    ? ampNormalizedCommandThunk()
+                    : normalizeCommandAmpAware(command);
+                if (!re.test(amp.normalized)) {
+                    const quoted = quoteNormalizedCommandThunk
+                        ? quoteNormalizedCommandThunk()
+                        : normalizeCommandQuoteAware(command);
+                    if (!re.test(quoted.normalized))
+                        return false;
+                }
+            }
         }
     }
     return true;
@@ -131,13 +168,79 @@ function outcomeForFailedRequires(enforcement) {
  *     `requires:` (an operator runs `harness approve risk`); once the
  *     tag is on record the requires evaluation passes and the outcome
  *     is `allow` instead.
+ *   - `deny-degraded` aborts (task f1aea826): it is only ever produced
+ *     for `block` / `require_approval` policies under the default
+ *     `preserve_enforcement` posture (see `degradedOutcome`), so its
+ *     presence alone means "an incident-preventing gate could not read
+ *     its evidence" — fail closed.
  *   - `allow` / `warn` / `warn-degraded` never abort.
+ *
+ * Exported for the CLI wrapper's pending-approval staging
+ * (`src/cli/policy/intercept.ts`), which must agree with the runtime on
+ * WHICH decision is the first blocking one — a hand-rolled copy there
+ * drifted when `deny-degraded` was added (review 2026-08-08, low
+ * finding). Keep this the single definition.
  */
-function isBlockingDecision(d) {
+export function isBlockingDecision(d) {
     if (d.outcome === "deny")
         return d.enforcement === "block";
+    if (d.outcome === "deny-degraded")
+        return true;
     return d.outcome === "require_approval";
 }
+/**
+ * Outcome for a policy whose `requires` could NOT be evaluated at all —
+ * degraded/thrown ledger query, unresolved template variables, invalid
+ * `within`, thrown `evaluateRequires`, or the defensive
+ * schema-invariant branch. The fail posture is derived from the
+ * policy's own `enforcement:` (task f1aea826):
+ *
+ *   warn                        → `warn-degraded` (availability first,
+ *                                 unchanged: advisory friction never
+ *                                 bricks the session)
+ *   block / require_approval    → `deny-degraded` (fail closed: a gate
+ *                                 against an irreversible incident must
+ *                                 not open because its evidence source
+ *                                 is unreadable)
+ *
+ * The manifest-level opt-out `risk.degraded_fail_posture: fail_open`
+ * restores the pre-0.45 availability-first mapping (`warn-degraded`
+ * for every tier). The hand-built-manifest case (`options.manifest.risk`
+ * absent, only possible past `harness validate`) defaults to the
+ * fail-closed posture, matching the schema default.
+ */
+function degradedOutcome(policy, manifest) {
+    if (policy.enforcement === "warn")
+        return "warn-degraded";
+    const posture = manifest.risk?.degraded_fail_posture ?? "preserve_enforcement";
+    return posture === "fail_open" ? "warn-degraded" : "deny-degraded";
+}
+/**
+ * Control characters (C0 range plus DEL), built via fromCharCode so the
+ * source file itself stays free of raw control bytes. Matches what the
+ * envelope sanitiser collapses to a single space.
+ */
+const ENVELOPE_CONTROL_CHARS = new RegExp(`[${String.fromCharCode(0)}-${String.fromCharCode(31)}${String.fromCharCode(127)}]+`, "g");
+/**
+ * Bound and clean a transport-level reason before it is interpolated
+ * into the agent-facing deny-degraded envelope. The string can embed
+ * output captured from the grounding-mcp SUBPROCESS (`exitDiagnostic`
+ * in `src/policies/ledger-client.ts` appends the child's last stderr
+ * line), i.e. untrusted content that previously only reached stderr
+ * and the audit ledger, never model-visible text. The full, untouched
+ * string still goes to the audit row and the verbose diagnostic; only
+ * the envelope interpolation and the default-verbosity operator hint
+ * are bounded.
+ *
+ * Exported for the CLI wrapper's deny-degraded operator hint (review
+ * 2026-08-08, round 3; default-verbosity only, suppressed under
+ * verbose), which interpolates the same untrusted reason into its
+ * one-line stderr surface.
+ */
+export function sanitizeEnvelopeReason(reason) {
+    const stripped = reason.replace(ENVELOPE_CONTROL_CHARS, " ");
+    return stripped.length > 200 ? `${stripped.slice(0, 200)}...` : stripped;
+}
 /**
  * Placeholder `ledgerTag` recorded on an `operator_only` decision (and on
  * the defensive schema-invariant-violated branch below). Both outcomes
@@ -178,21 +281,23 @@ async function evaluateOnePolicy(policy, options) {
         // Defensive branch only, for a manifest that bypassed
         // `harness validate` (hand-built Policy object, stale cached parse).
         //
-        // Deliberately `warn-degraded`, not `deny`: this is the SAME "could
-        // not decide" fail-open family as the other `warn-degraded` returns
-        // in this function (unresolved template variables, a degraded
-        // ledger query, an invalid `within`, a throwing `evaluateRequires`)
-        // — the contract for all of them is "the evaluator could not form a
-        // real verdict, so it never blocks and never silently allows either;
-        // it is loud instead" (recorded to the audit ledger and returned as
-        // a non-`allow`, non-`deny` outcome). Failing this branch `deny`
-        // would treat an internal schema-invariant violation as if it were a
-        // deliberate `operator_only: true` policy authored by the operator,
-        // which it is not — the two must stay observably distinct.
+        // Deliberately NOT a plain `deny`: this is the SAME "could not
+        // decide" family as the other degraded returns in this function
+        // (unresolved template variables, a degraded ledger query, an
+        // invalid `within`, a throwing `evaluateRequires`) — the contract
+        // for all of them is "the evaluator could not form a real verdict",
+        // routed through `degradedOutcome` so the policy's own enforcement
+        // decides the fail posture (task f1aea826): `warn` stays the
+        // non-blocking `warn-degraded`, `block`/`require_approval` fail
+        // closed as `deny-degraded`. Failing this branch as plain `deny`
+        // would treat an internal schema-invariant violation as if it were
+        // a deliberate `operator_only: true` policy authored by the
+        // operator, which it is not — `deny-degraded` keeps the two
+        // observably distinct in every audit row and envelope.
         return {
             policyName: policy.name,
             enforcement: policy.enforcement,
-            outcome: "warn-degraded",
+            outcome: degradedOutcome(policy, options.manifest),
             reason: "policy declares neither requires: nor operator_only: true (schema invariant violated)",
             extractValues: extract.values,
             ledgerTag: NO_LEDGER_TAG,
@@ -209,7 +314,7 @@ async function evaluateOnePolicy(policy, options) {
         return {
             policyName: policy.name,
             enforcement: policy.enforcement,
-            outcome: "warn-degraded",
+            outcome: degradedOutcome(policy, options.manifest),
             reason: `template variables unresolved: ${unresolved.join(", ")}`,
             extractValues: extract.values,
             ledgerTag,
@@ -231,7 +336,7 @@ async function evaluateOnePolicy(policy, options) {
         return {
             policyName: policy.name,
             enforcement: policy.enforcement,
-            outcome: "warn-degraded",
+            outcome: degradedOutcome(policy, options.manifest),
             reason: queryResult.reason,
             extractValues: extract.values,
             ledgerTag,
@@ -248,7 +353,7 @@ async function evaluateOnePolicy(policy, options) {
             return {
                 policyName: policy.name,
                 enforcement: policy.enforcement,
-                outcome: "warn-degraded",
+                outcome: degradedOutcome(policy, options.manifest),
                 reason: `invalid within: ${requires.within}`,
                 extractValues: extract.values,
                 ledgerTag,
@@ -272,7 +377,7 @@ async function evaluateOnePolicy(policy, options) {
         return {
             policyName: policy.name,
             enforcement: policy.enforcement,
-            outcome: "warn-degraded",
+            outcome: degradedOutcome(policy, options.manifest),
             reason: `requires eval threw: ${err.message}`,
             extractValues: extract.values,
             ledgerTag,
@@ -323,6 +428,325 @@ function filterEntriesByTag(entries, tag) {
         (e.content.includes(tag) ||
             (e.source !== undefined && e.source.includes(tag))));
 }
+/**
+ * Which of a policy's own trigger-satisfying segments name a target — the
+ * attribution sibling of `policyMatchesEvent` (task `98ad072f`, T-003).
+ * Re-tests the policy's OWN `bash_match` regex against each segment's
+ * `text` in isolation: every shipped `bash_match` alternation includes a
+ * `^` branch, so testing it against one segment's canonicalised text
+ * alone (no leading boundary character — see `CommandSegment.text`'s own
+ * doc comment) is well-defined. Returns every segment that matches on its
+ * own — usually one, occasionally several (D-004: a decoy read and a cwd
+ * read chained in one command can each independently satisfy the SAME
+ * trigger).
+ *
+ * Never changes WHETHER a policy matches — `policyMatchesEvent` already
+ * decided that from the WHOLE command (raw-or-normalised-or-amp-
+ * normalised), unchanged by this function. This only narrows down WHICH
+ * segment(s), if any, are individually responsible for the match, so
+ * `intercept()` below knows which segment's target — if any — to resolve
+ * the `${REPO}`/`${BRANCH}`/`currentHeadSha` builtins from instead of the
+ * event's own cwd. `[]` when the policy has no `bash_match` trigger (an
+ * MCP-tool-name-triggered policy — no segment concept applies), when its
+ * regex is malformed (mirrors `policyMatchesEvent`'s own defensive
+ * `try/catch`), or when the whole-command match came ONLY from the
+ * ampersand-aware third arm: `segments` here is always built from the
+ * PRIMARY (`BOUNDARY_RE`) segmentation, which — by construction — cannot
+ * itself contain the bare-`&` split the amp arm relies on, so an amp-
+ * only match finds no individually-matching segment and this returns
+ * `[]` (D-003: cwd builtins, identical to shipped).
+ */
+export function attributeTriggerSegments(policy, segments) {
+    if (policy.trigger.bash_match === undefined)
+        return [];
+    let re;
+    try {
+        re = new RegExp(policy.trigger.bash_match);
+    }
+    catch {
+        return [];
+    }
+    return segments.filter((seg) => re.test(seg.text));
+}
+/**
+ * Does a policy's `requires:` reference the per-repo `${REPO}`/`${BRANCH}`
+ * builtins, or ask for `at_head`? Only these policies pay the per-policy
+ * attribution cost below — every other matching policy keeps the plain,
+ * per-event cwd builtins `options.builtins` already carries, byte-
+ * identical to before this task. D-005: `at_head` is included even when
+ * `ledger_tag` itself doesn't reference `${REPO}`/`${BRANCH}`, because
+ * `at_head` compares against `currentHeadSha`, which this task resolves
+ * from the SAME per-policy context — splitting the two would check
+ * `at_head` against the cwd's HEAD while `${REPO}` (if present elsewhere)
+ * named a different repo, the worse inconsistency D-005 rejects.
+ */
+function usesPerRepoBuiltins(policy) {
+    const requires = policy.requires;
+    if (requires === undefined)
+        return false;
+    return (requires.at_head === true ||
+        requires.ledger_tag.includes("${REPO}") ||
+        requires.ledger_tag.includes("${BRANCH}"));
+}
+/**
+ * Bound on the number of DISTINCT attributed contexts one policy is
+ * evaluated against for one event (D-013, fix round, run
+ * 2026-08-02-per-repo-gate-scoping-redesign). Each distinct context costs
+ * one ledger query and one audit write in `intercept()`'s evaluation loop
+ * below; on a manifest with several per-repo-builtins policies (the
+ * shipped `FULL_TEMPLATE` has four), an event naming K distinct targets
+ * amplifies to 4K queries/writes, unbounded by `MAX_NORMALIZE_LENGTH` —
+ * measured 200/200 at K=200 by reviewer 2, on a hook budget whose timeout
+ * is ALLOW (same class as the 07-27 quadratic hot-path fail-open: a slow
+ * enough event silently passes). `resolveAttributedContexts` returns a
+ * `"bounded"` result instead of a `contexts` array once a policy's DISTINCT
+ * targets would exceed this constant; `intercept()` denies that policy
+ * directly (naming the ambiguity) without querying the ledger for any of
+ * them, rather than silently evaluating all of them.
+ */
+export const MAX_ATTRIBUTED_CONTEXTS = 4;
+/**
+ * Realpath a path for identity comparison, never throwing (D-012, fix
+ * round, run 2026-08-02-per-repo-gate-scoping-redesign). Falls back to the
+ * LEXICAL path unchanged when the target does not exist or is otherwise
+ * unreadable (`fs.realpathSync.native` throws `ENOENT` for a path this
+ * module was never guaranteed to have on disk, and this function must
+ * never throw — same fail-safe posture as `resolveGitContext` itself,
+ * which returns empty strings rather than throwing on a bad path).
+ * `.native` (not the plain JS `fs.realpathSync`) resolves via the OS
+ * syscall directly — cheaper, and avoids Node's own pure-JS symlink-loop
+ * bookkeeping for a value this function only uses for an identity
+ * comparison, never for a filesystem walk of its own.
+ */
+function realpathOrSelf(p) {
+    try {
+        return fs.realpathSync.native(p);
+    }
+    catch {
+        return p;
+    }
+}
+/**
+ * Resolve the distinct `${REPO}`/`${BRANCH}`/`currentHeadSha` contexts a
+ * `usesPerRepoBuiltins` policy must be evaluated against (task `98ad072f`,
+ * T-003, `01-plan.md` Proposed Approach items 2-4). The engine trusts a
+ * trigger-satisfying segment's `effectiveTarget` UNIFORMLY as the
+ * directory that segment's own invocation genuinely runs in (bash
+ * semantics) — orchestrator decision D-010, 2026-08-02: an earlier
+ * revision of this function additionally distrusted an inherited target
+ * whenever a DIFFERENT invocation intervened between the `cd` and the
+ * satisfying segment — REJECTED: that coupling has no basis in bash's own
+ * semantics, is dodgeable by inserting any harmless read between the `cd`
+ * and the gated verb, and carried its own unverified `cd`-recognition
+ * gap. The `cd <B> && git log && git push` shape this was meant to guard
+ * is not a regression at all under this design — `git push` genuinely
+ * runs inside B — see `tests/runtime/intercept-cli.test.ts`'s "leading-cd
+ * is now a deliverable" block.
+ *
+ * D-021 (UNIVERSAL-ADDITIVE, operator decision, fix round, run
+ * 2026-08-02-per-repo-gate-scoping-redesign): attribution is uniformly
+ * ADDITIVE, never REPLACE. Every satisfying segment with an attributable
+ * target — `seg.effectiveTarget !== null`, whether it came from the
+ * segment's OWN explicit repo-relocating flag (`-C`/`env -C`/`--git-dir`;
+ * `--work-tree` is excluded from ever producing a target at all, D-017)
+ * or was INHERITED from a preceding `cd` — demands the cwd context AND
+ * that target's own context, side by side; `seg.ownTarget` is not
+ * consulted for this decision. Any unsatisfied context blocks the whole
+ * event (the existing per-context evaluation machinery below is
+ * unchanged). `seg.effectiveTarget === null` (fully unattributable —
+ * D-003) still adds ONLY the cwd context — there is no foreign target to
+ * be additive WITH.
+ *
+ * Demanding cwd unconditionally makes the engine structurally immune to
+ * misattribution of the foreign target: no gap in `command-normalize.ts`'s
+ * static, string-only model of shell control flow (subshells, pipes,
+ * `cd -`, a later `cd`, an unmodeled git flag composition) can ever make a
+ * gate WEAKER than the shipped, cwd-only engine, because cwd's own demand
+ * is never dropped — only added to. This replaces an earlier REPLACE-for-
+ * own-target design (D-011) that trusted a statically extracted own
+ * target as proof of "this one invocation operates there"; four
+ * independent review passes each measured a live bypass of that
+ * invariant against the shipped binary (a forged `.git/HEAD` directory
+ * reached through, respectively, a non-persisting `cd`, `--work-tree`,
+ * more than one repo-relocating flag, and a tilde-valued flag not counted
+ * by the multi-flag guard) — see `03-decisions.md` D-011/D-017/D-018/
+ * D-019/D-020/D-021 for the full history. The static-analysis-proves-it
+ * invariant those bypasses each disproved is not carried forward here.
+ * Cost accepted by the operator: a legitimate `git -C B` from cwd A now
+ * demands BOTH A's and B's context, where the pre-D-021 engine demanded
+ * only B's.
+ *
+ * D-012: a target reached through a symlink resolves to its REAL
+ * (realpath'd) repository identity, not the symlink's own lexical
+ * basename — `resolveGitContext` derives `repo` from the basename of
+ * wherever it's pointed, and never itself realpaths, so an agent could
+ * otherwise pick the demanded repo identity by naming a symlink.
+ *
+ * D-013: distinct contexts are bounded at `MAX_ATTRIBUTED_CONTEXTS`; see
+ * that constant's own comment.
+ *
+ * D-015: the cwd context is deduped by its OWN `[REPO, BRANCH, sha]`
+ * signature (not the literal string `"cwd"`), so a foreign path that
+ * resolves to the SAME repository identity as cwd (e.g. a subdirectory of
+ * the cwd repo reached via an explicit `-C`) collapses into the cwd
+ * context instead of producing a spurious duplicate decision/audit write.
+ * `repoOverridden` / `branchOverridden` (from `InterceptOptions`, both
+ * default `false`) keep an operator's `HARNESS_REPO`/`HARNESS_BRANCH`
+ * override intact in an attributed foreign context instead of letting the
+ * target repo's own identity silently overwrite it — independently per
+ * field. `satisfying` is a `Set` (not `Array.includes` per segment) for
+ * O(1) membership tests instead of O(n) per segment.
+ *
+ * A policy with no attributable foreign target (no `bash_match`, no
+ * individually-matching segment, only an amp-arm-only match, an
+ * unattributable composition, a target resolving to the SAME repository
+ * identity as cwd, or a target outside any git repo — D-003) is evaluated
+ * EXACTLY as it is today, with the EXACT SAME `options.builtins` object
+ * reference (no clone) when nothing attributed, keeping that the
+ * byte-identical common case.
+ *
+ * `resolveGitContextMemo` is a per-`intercept()`-call cache keyed by the
+ * REALPATH'D absolute path (never module-level state — no cross-event
+ * caching), so several policies (or several satisfying segments) naming
+ * the same foreign path within one event pay the `fs` cost once, not
+ * once per policy per segment.
+ */
+function resolveAttributedContexts(policy, segments, cwdBuiltins, cwdCurrentHeadSha, resolveGitContextMemo, repoOverridden, branchOverridden) {
+    const cwdContext = { builtins: cwdBuiltins, currentHeadSha: cwdCurrentHeadSha };
+    const satisfying = new Set(attributeTriggerSegments(policy, segments));
+    if (satisfying.size === 0)
+        return { kind: "contexts", contexts: [cwdContext] };
+    const cwdSignature = [cwdBuiltins.REPO, cwdBuiltins.BRANCH, cwdCurrentHeadSha ?? ""].join("|");
+    const seenSignatures = new Set();
+    const contexts = [];
+    const addCwdOnce = () => {
+        if (seenSignatures.has(cwdSignature))
+            return;
+        seenSignatures.add(cwdSignature);
+        contexts.push(cwdContext);
+    };
+    const cwdReal = realpathOrSelf(cwdBuiltins.CWD);
+    for (const seg of segments) {
+        if (!satisfying.has(seg))
+            continue;
+        if (seg.effectiveTarget === null) {
+            // D-003: fully unattributable — cwd only, no foreign target to be
+            // additive with.
+            addCwdOnce();
+            continue;
+        }
+        // D-021 (UNIVERSAL-ADDITIVE, operator decision after the four-pass
+        // halt — see this function's own doc comment): the cwd context is
+        // demanded UNCONDITIONALLY here, regardless of whether the target came
+        // from the segment's own explicit flag or was inherited from a
+        // preceding `cd`. `seg.ownTarget` is no longer read for this decision.
+        addCwdOnce();
+        const resolvedLexical = path.resolve(cwdBuiltins.CWD, seg.effectiveTarget);
+        const resolved = realpathOrSelf(resolvedLexical);
+        if (resolved === cwdReal) {
+            addCwdOnce();
+            continue;
+        }
+        let gitCtx = resolveGitContextMemo.get(resolved);
+        if (gitCtx === undefined) {
+            gitCtx = resolveGitContext(resolved);
+            resolveGitContextMemo.set(resolved, gitCtx);
+        }
+        if (gitCtx.repo.length === 0) {
+            // D-003: outside any repo → cwd fallback, not a distinct context.
+            addCwdOnce();
+            continue;
+        }
+        const signature = [gitCtx.repo, gitCtx.branch, gitCtx.sha].join("|");
+        if (signature === cwdSignature) {
+            // D-015: a foreign target that resolves to cwd's own REAL identity
+            // (e.g. a subdirectory of the cwd repo reached via `-C`, a
+            // different literal path than `cwdBuiltins.CWD` itself but the SAME
+            // `.git`) collapses into the cwd context regardless of segment
+            // order — not just when a bare cwd-reading segment happened to add
+            // it first.
+            addCwdOnce();
+            continue;
+        }
+        if (seenSignatures.has(signature))
+            continue;
+        if (contexts.length >= MAX_ATTRIBUTED_CONTEXTS) {
+            // D-013: fail CLOSED — do not evaluate any of them, name the
+            // ambiguity instead. `contexts.length + 1` names "at least this
+            // many distinct targets", the count observed before bailing, not
+            // necessarily the final total (the loop stops here).
+            return { kind: "bounded", distinctCount: contexts.length + 1 };
+        }
+        seenSignatures.add(signature);
+        contexts.push({
+            builtins: {
+                ...cwdBuiltins,
+                REPO: repoOverridden ? cwdBuiltins.REPO : gitCtx.repo,
+                BRANCH: branchOverridden ? cwdBuiltins.BRANCH : gitCtx.branch,
+            },
+            currentHeadSha: gitCtx.sha.length > 0 ? gitCtx.sha : undefined,
+        });
+    }
+    // Defensive fallback: every satisfying segment existed but somehow none
+    // was added above (should not happen — every branch above adds either
+    // the cwd context or a foreign one). Never leave a matched, per-repo-
+    // builtins policy with zero contexts to evaluate against.
+    return { kind: "contexts", contexts: contexts.length > 0 ? contexts : [cwdContext] };
+}
+/**
+ * Lazily resolve the event's per-segment view for attribution, computed
+ * at most once per `intercept()` call (the caller, `intercept()` below,
+ * memoises the RESULT in its own `segmentsForAttribution` local — this
+ * function itself is called at most once per call already, but stays
+ * side-effect-free so that remains true regardless of caller changes).
+ * Prefers `options.commandSegmentsThunk` (D-015 fix round: the deferred,
+ * compute-only-if-needed seam — see its own doc comment), then the eager
+ * `options.commandSegments`, then falls back to computing it directly
+ * from the event's own command for standalone callers/tests that inject
+ * neither. `null` (truncated — see `segmentViewOf`) and "no Bash command
+ * on this event" both collapse to `[]`, the same "nothing to attribute,
+ * cwd builtins" shape as a policy with no `bash_match` at all.
+ */
+function resolveCommandSegments(options) {
+    if (options.commandSegmentsThunk !== undefined)
+        return options.commandSegmentsThunk() ?? [];
+    if (options.commandSegments !== undefined)
+        return options.commandSegments ?? [];
+    const command = extractShellCommand(options.event);
+    if (command === null)
+        return [];
+    return segmentViewOf(command) ?? [];
+}
+/**
+ * Synthesise the single decision `intercept()` records for a policy whose
+ * distinct attributed contexts exceeded `MAX_ATTRIBUTED_CONTEXTS` (D-013).
+ * Routes through `outcomeForFailedRequires` — the SAME enforcement-to-
+ * outcome mapping every other "could not safely evaluate" branch in
+ * `evaluateOnePolicy` uses — rather than a hardcoded outcome, so a
+ * `block`-enforcement policy (the security-critical case: preflight/push/
+ * merge gates) genuinely denies, while a `warn`-enforcement policy warns
+ * instead of hard-blocking, consistent with how every other failed-
+ * evaluation branch in this module already respects the policy's own
+ * declared enforcement. No ledger query, no template substitution against
+ * a resolved `ledger_tag` (there is no single context to substitute one
+ * against) — `extractValues` is still computed from `trigger.extract`
+ * against the CWD builtins (cheap, pure, matches the `operator_only`
+ * short-circuit's own reasoning) so a `ux:`/`producers:` block on this
+ * policy can still render.
+ */
+function boundedContextsDecision(policy, event, distinctCount, cwdBuiltins, evaluatedAt) {
+    const extract = evaluateExtract(policy.trigger.extract ?? {}, buildEventContext(event), cwdBuiltins);
+    return {
+        policyName: policy.name,
+        enforcement: policy.enforcement,
+        outcome: outcomeForFailedRequires(policy.enforcement),
+        reason: `ambiguous: this command names at least ${distinctCount} distinct repository targets for this policy, ` +
+            `exceeding the ${MAX_ATTRIBUTED_CONTEXTS}-context bound — refusing to evaluate all of them`,
+        extractValues: extract.values,
+        ledgerTag: "(bounded: too many distinct attributed targets — no context queried)",
+        evaluatedAt,
+    };
+}
 export async function intercept(options) {
     const { manifest, event } = options;
     // The Risk Gate is active only when some policy declares a `when:`
@@ -351,8 +775,9 @@ export async function intercept(options) {
     const whenFallbackMap = new Map();
     const matching = [];
     for (const p of manifest.policies) {
-        if (!policyMatchesEvent(p, event, options.normalizedCommand))
+        if (!policyMatchesEvent(p, event, options.normalizedCommand, options.ampNormalizedCommandThunk, options.quoteNormalizedCommandThunk)) {
             continue;
+        }
         if (p.when === undefined) {
             matching.push(p);
             continue;
@@ -364,34 +789,73 @@ export async function intercept(options) {
             matching.push(p);
         }
     }
+    // Per-policy attribution (task `98ad072f`, T-003): `segmentsForAttribution`
+    // is resolved at most once, lazily, only if some matching policy actually
+    // uses `${REPO}`/`${BRANCH}`/`at_head` — a manifest with none of those
+    // (every Phase 4/5/6-only manifest) never computes it.
+    // `resolveGitContextMemo` is this call's own, non-module-level cache
+    // (task constraint: no eager/global filesystem work) — see
+    // `resolveAttributedContexts`'s own comment.
+    let segmentsForAttribution;
+    const resolveGitContextMemo = new Map();
     const decisions = [];
     for (const policy of matching) {
-        const base = await evaluateOnePolicy(policy, options);
-        // Attach the per-event Risk Gate verdicts so `harness audit` /
-        // `explain --trace` can replay the classification + environment
-        // that the `when:` match was made against. Also carry the
-        // unclassifiedFallback flag (M7) when the when: evaluation set it
-        // to true; leave the field absent otherwise so decisions from
-        // manifests without a `when:` policy stay byte-identical.
-        const whenFallback = whenFallbackMap.get(policy.name);
-        const decision = enriched
-            ? {
-                ...base,
-                risk: enriched.risk,
-                environment: enriched.environment,
-                ...(whenFallback === true ? { whenUnclassifiedFallback: true } : {}),
+        const attributed = usesPerRepoBuiltins(policy)
+            ? resolveAttributedContexts(policy, (segmentsForAttribution ??= resolveCommandSegments(options)), options.builtins, options.currentHeadSha, resolveGitContextMemo, options.repoOverridden === true, options.branchOverridden === true)
+            : { kind: "contexts", contexts: [{ builtins: options.builtins, currentHeadSha: options.currentHeadSha }] };
+        if (attributed.kind === "bounded") {
+            // D-013: fail CLOSED without querying the ledger for any of the
+            // (too many) distinct targets — one synthetic decision, one audit
+            // write, then move on to the next policy. Ledger-query count for
+            // THIS policy stays at zero regardless of how many distinct targets
+            // the command actually names, instead of scaling with them.
+            const evaluatedAt = (options.now ?? new Date()).toISOString();
+            const decision = boundedContextsDecision(policy, event, attributed.distinctCount, options.builtins, evaluatedAt);
+            decisions.push(decision);
+            try {
+                await options.ledger.record(decision, resolveSessionId(event.session_id));
             }
-            : base;
-        decisions.push(decision);
-        try {
-            await options.ledger.record(decision, resolveSessionId(event.session_id));
+            catch (err) {
+                (options.stderr ?? process.stderr).write(`harness runtime intercept: audit-write failed for ${decision.policyName}: ${err instanceof Error ? err.message : String(err)}\n`);
+            }
+            continue;
         }
-        catch (err) {
-            // Audit-write failure must not block; the decision is still applied.
-            // Surface the failure to stderr so a persistently-failing recorder
-            // does not silently leave `harness audit` / `explain --trace` blind.
-            // Goes to stderr to keep the stdout deny-JSON contract intact.
-            (options.stderr ?? process.stderr).write(`harness runtime intercept: audit-write failed for ${decision.policyName}: ${err instanceof Error ? err.message : String(err)}\n`);
+        for (const context of attributed.contexts) {
+            // Same object reference as `options` on the (overwhelmingly common)
+            // single-cwd-context path — no clone, byte-identical to the
+            // pre-attribution call shape. Only a genuinely foreign context
+            // builds a shallow override.
+            const contextOptions = context.builtins === options.builtins &&
+                context.currentHeadSha === options.currentHeadSha
+                ? options
+                : { ...options, builtins: context.builtins, currentHeadSha: context.currentHeadSha };
+            const base = await evaluateOnePolicy(policy, contextOptions);
+            // Attach the per-event Risk Gate verdicts so `harness audit` /
+            // `explain --trace` can replay the classification + environment
+            // that the `when:` match was made against. Also carry the
+            // unclassifiedFallback flag (M7) when the when: evaluation set it
+            // to true; leave the field absent otherwise so decisions from
+            // manifests without a `when:` policy stay byte-identical.
+            const whenFallback = whenFallbackMap.get(policy.name);
+            const decision = enriched
+                ? {
+                    ...base,
+                    risk: enriched.risk,
+                    environment: enriched.environment,
+                    ...(whenFallback === true ? { whenUnclassifiedFallback: true } : {}),
+                }
+                : base;
+            decisions.push(decision);
+            try {
+                await options.ledger.record(decision, resolveSessionId(event.session_id));
+            }
+            catch (err) {
+                // Audit-write failure must not block; the decision is still applied.
+                // Surface the failure to stderr so a persistently-failing recorder
+                // does not silently leave `harness audit` / `explain --trace` blind.
+                // Goes to stderr to keep the stdout deny-JSON contract intact.
+                (options.stderr ?? process.stderr).write(`harness runtime intercept: audit-write failed for ${decision.policyName}: ${err instanceof Error ? err.message : String(err)}\n`);
+            }
         }
     }
     // First blocking decision wins the envelope. `deny` and
@@ -438,7 +902,35 @@ export async function intercept(options) {
         // `run:` is the canonical remedy surface and rendering both would
         // give the agent two different command suggestions.
         let reasonText;
-        if (blockingPolicy?.ux) {
+        if (blocking.outcome === "deny-degraded") {
+            // Degraded-specific envelope (task f1aea826). Deliberately takes
+            // precedence over the policy's `ux:` surface: the operator-curated
+            // ux text describes the MISSING-evidence case ("run the producer,
+            // then retry"), which is actively misleading here — the evidence
+            // could not be READ, so producing the tag cannot unblock anything
+            // until the ledger is reachable again. The envelope names the real
+            // cause (the transport-level reason, sanitised — it embeds output
+            // from the grounding-mcp subprocess) and the posture, so nobody
+            // debugs a phantom missing tag.
+            //
+            // The `risk.degraded_fail_posture: fail_open` opt-out is
+            // deliberately NOT named here (review 2026-08-08, high finding):
+            // this text is fed back to the very agent that was just blocked,
+            // and nothing prevents that agent from editing the manifest — a
+            // deny that includes its own disable recipe is not a gate. The
+            // opt-out lives on operator surfaces only: the stderr diagnostic
+            // (`formatDecisionDiagnostic`), docs/risk-gate.md, and the OKF
+            // fail-posture matrix. Same reasoning as the producer-neutrality
+            // norm above and the operator-only framing of `harness pause`.
+            reasonText =
+                `${blocking.policyName}: required evidence could not be read ` +
+                    `(evidence ledger degraded: ${sanitizeEnvelopeReason(blocking.reason)}). ` +
+                    `This ${blocking.enforcement} policy fails closed while its evidence ` +
+                    `source is unreadable; producing the required tag will not unblock it ` +
+                    `until the ledger is reachable again. Ask your operator to check ` +
+                    `grounding-mcp (harness doctor), then retry. Session: ${sessionId}.`;
+        }
+        else if (blockingPolicy?.ux) {
             // The ux surface is operator-curated plain language. The
             // unclassifiedFallback flag rides the audit record (recorded above
             // and surfaced by `harness audit` and `explain --trace`) so operators