arcane-cli 1.5.1 → 1.6.0

package/README.md

@@ -220,6 +220,43 @@ spell init --profile full
 spell add agent-policies   # or install any component à la carte
 ```
 
+### Setup questions, answered by flags
+
+`spell init` asks a few questions about the repository and records the answers in `.arcane.json`; `spell update` asks any that an older install predates. Each question has a flag, on both commands, so a script or an agent harness can answer without a terminal:
+
+| Flag | Answers |
+| --- | --- |
+| `--role <hub\|consumer>` | Does this repository manage other ventures as a hub? |
+| `--tracking-mode <internal\|external>` | Is work tracked in this repository, or in an external tracker? |
+| `--external-provider <ado\|github\|jira\|other>` | Which tracker. Only with `--tracking-mode external`, which requires it. |
+| `--content-sensitivity <standard\|sensitive>` | May agents quote this repository's contents? |
+| `--push-policy <open\|guarded\|blocked>` | May this repository push to a remote? See [Push safety](#push-safety). |
+| `--subject-root <path>` | Which directory holds the subject's documents (docs profile). |
+
+```bash
+spell init --profile lite --tracking-mode internal --push-policy guarded
+spell update --role consumer --content-sensitivity standard
+```
+
+A flag answers its question with no prompt, even under `--profile`; a question without a flag is asked on a terminal and skipped without one. A run that skips questions prints the exact `spell update` line that answers them. Values are checked by the same validator as `.arcane.json`, and a bad one exits 1.
+
+A flag only ever answers a question that has no recorded answer yet. To change a recorded answer, edit `.arcane.json` deliberately; the flag is refused and names the current value. The one exception is `--push-policy`, which may also **tighten** a recorded policy (`open` → `guarded` → `blocked`). It can never loosen one.
+
+### Push safety
+
+A repository whose history must never reach a remote records `push_policy: "blocked"`, and gets two controls: a pre-push hook, and a disabled push URL on every remote. `guarded` installs nothing; `spell doctor` reports it, and the spells that push state it and ask first.
+
+```bash
+spell block-push     # enforce "blocked" on an initialized repository
+spell unblock-push   # lift it: interactive terminal only, and you type the repository name
+```
+
+- **`spell block-push`** installs exactly what `spell init` installs for `blocked`, with the same refusals. It never takes over a `core.hooksPath` that another hook manager owns, and it refuses when a push URL is configured outside the repository. It records `blocked` only once both controls are in force, so a refusal changes nothing. Running it again on an enforced repository reports that and changes nothing. It needs no terminal, because it can only tighten.
+- **`spell update` never installs push controls.** When it records `blocked`, from a question or from `--push-policy`, it tells you the policy is not enforced yet and to run `spell block-push` ([ARC-049](DECISIONS.md#arc-049--enforcing-a-recorded-push-policy-after-init)).
+- **Loosening is only possible through `spell unblock-push`, from an interactive terminal.** No flag, script or other command can move a repository from `blocked` or `guarded` toward `open`: `spell update --push-policy open` on a blocked repository exits 1 and points you at `spell unblock-push`.
+
+These controls stop an accidental push, not a determined operator ([ARC-034](DECISIONS.md#arc-034--push-safety-for-sensitive-repositories)).
+
 ### Once per machine
 
 Working across many Arcane repositories at once? Install the spells a single time at the **user tier**, instead of (or as well as) per repository:

package/dist/assets/.arcane/governance/agent-approved-paths.md

@@ -2,7 +2,7 @@
 title: Agent Approved Paths Registry
 audience: both
 last_updated: YYYY-MM-DD
-status: active
+status: template
 distributable: true
 tags: [agent, security, filesystem, autonomy]
 ---

package/dist/assets/.arcane/governance/git-conventions.md

@@ -296,7 +296,7 @@ The agent slug prefix makes branch ownership obvious in `git branch -r` output a
    instead of the `spell-create-pull-request` spell.**
    ```bash
    git fetch origin
-   git rebase origin/main
+   git rebase --autostash origin/main
    # If conflicts arise: resolve → git add → git rebase --continue
    ```
    This ensures the PR diff is clean, the CI runs against current main, and reviewers see no
@@ -542,13 +542,31 @@ If your tracker links commits to work items by ID (Azure Boards, GitHub Issues,
 
 ---
 
+## Push safety
+
+A repository that holds sensitive material can record how far it trusts a push, in the `push_policy` field of `.arcane.json`. One accidental push can publish a repository's whole history, and deleting the content afterwards does not undo that. The threat this guards against is an **accidental** push (the wrong remote, habit carried over from another repository, an unsupervised agent). It does not stop a determined operator: every control below can be reversed by someone who decides to reverse it. See ARC-034 and ARC-049 in Arcane's own decision log for the full reasoning. **Enforcement: explicitly advisory prose (ARC-023) — this paragraph describes the model; the rules below carry their own annotations.**
+
+| `push_policy` | Meaning | What is installed |
+| --- | --- | --- |
+| `open` (the default, and what an absent field means) | Pushes proceed as normal. | Nothing. |
+| `guarded` | Every push needs the operator's explicit confirmation. | Nothing. `spell doctor` reports the policy and the push targets, and push-performing spells ask before each push. |
+| `blocked` | No push is attempted. | A `pre-push` hook, and a sentinel push URL on every remote configured when the policy is applied. Fetch URLs are untouched, so the repository can still pull. |
+
+- **Set:** `spell init` asks the question once and records the answer. `spell update` asks it in a repository that has no answer yet, records the answer, and installs nothing mid-update; when it records `blocked` it says the policy is not yet enforced and names `spell block-push`. Both commands also take `--push-policy <open|guarded|blocked>`, which may set an unset policy or tighten one, never loosen it. **Enforcement: executable check (ARC-023) — the CLI validates the value against the three allowed ones and refuses a loosening flag; the question and notice text are the CLI's own output.**
+- **Enforce:** `spell block-push` installs the `blocked` controls, the same ones `spell init` installs, and records `blocked` if the repository was `open` or `guarded`. It only tightens, so it needs no interactive terminal, and it is idempotent. As `spell init` does, it refuses rather than overwrite a `core.hooksPath` another hook manager owns; unlike `spell init`, it then touches no push URL. A remote whose push URL is configured outside the repository cannot be covered: the command protects everything else it can, leaves the manifest's policy unchanged, and exits non-zero, so the record never claims a protection the repository lacks. When `spell init` itself cannot put a recorded block fully in force, it names `spell block-push` and exits non-zero. **Enforcement: executable check (ARC-023) — the pre-push hook and the sentinel push URL refuse the push at the git level; the hook alone is skipped by `--no-verify`, and the URL alone is skipped by a push to an explicit URL, which is why both are installed.**
+- **Verify:** `spell doctor` reports a `guarded` policy on every run, with the remotes a push would reach, and reports a `blocked` policy whose hook or push URLs are missing as declared but not enforced. **Enforcement: executable check (ARC-023) — `spell doctor`'s push-policy check reads the effective hook and push-URL state; it is a non-blocking finding the operator runs on demand, not a CI gate.**
+- **Lift:** `spell unblock-push` is the only way to loosen a policy. It requires an interactive terminal and the repository name typed back, and records `open` with a timestamp. No flag, spell, or non-interactive path may move a repository from `blocked` or `guarded` toward `open`, and `spell uninstall` refuses while a block stands. **Enforcement: executable check (ARC-023) — the command refuses without an interactive terminal; a pseudo-terminal defeats that check, so it bars scripts rather than a determined actor.**
+- **Read by spells:** every spell that pushes — `spell-commit-work`, `spell-create-pull-request`, `spell-ship`, `spell-sync-pull-request`, `spell-close-session` and `spell-address-review` — reads `push_policy` before each push, through the shared `_fragments/push-policy-check.md` text. Under `guarded` it states the policy and asks the operator before the push; in an autonomous run with no operator to ask, it does not push and reports the pending push. Under `blocked` it does not attempt the push, says why, and names `spell unblock-push`. **Enforcement: structured spell gate (ARC-023) — for `guarded`, the spell's confirmation step is the only control, and an agent that pushes outside these spells is not held by it; for `blocked`, the installed controls above refuse the push as well.**
+
+---
+
 ## PR Standards
 
 All pull requests — whether created by humans or agents — must meet these requirements.
 
 ### 🛑 Agent-mandatory pre-PR guard
 
-> **AGENTS: BEFORE running any PR-creation tool (`az repos pr create`, `gh pr create`, the `create_pull_request` MCP tool, or any equivalent), you MUST run `git fetch origin && git rebase origin/<target-branch>` and resolve any conflicts. This is not optional. Skipping this step is a governance violation. Enforcement: structured spell gate (ARC-023) — `spell-create-pull-request` Step 0's mandatory rebase guard (its Step 0.6) and `spell-commit-work` Step 9b both require this fetch/rebase sequence before any PR-creation call — backed by an executable check: `.github/workflows/ci.yml`'s `rebase-check` job ("PR branch is rebased on target") independently re-verifies `origin/<base>` is an ancestor of HEAD via `git merge-base --is-ancestor` on every PR, and this repo's own live GitHub ruleset ("protect main") lists that exact check in `required_status_checks` with `current_user_can_bypass: "never"` — an unrebased PR cannot merge even if the spell-level guard were skipped.**
+> **AGENTS: BEFORE running any PR-creation tool (`az repos pr create`, `gh pr create`, the `create_pull_request` MCP tool, or any equivalent), you MUST run `git fetch origin && git rebase --autostash origin/<target-branch>` and resolve any conflicts. This is not optional. Skipping this step is a governance violation. Enforcement: structured spell gate (ARC-023) — `spell-create-pull-request` Step 0's mandatory rebase guard (its Step 0.6) and `spell-commit-work` Step 9b both require this fetch/rebase sequence before any PR-creation call — backed by an executable check: `.github/workflows/ci.yml`'s `rebase-check` job ("PR branch is rebased on target") independently re-verifies `origin/<base>` is an ancestor of HEAD via `git merge-base --is-ancestor` on every PR, and this repo's own live GitHub ruleset ("protect main") lists that exact check in `required_status_checks` with `current_user_can_bypass: "never"` — an unrebased PR cannot merge even if the spell-level guard were skipped.**
 
 This rule applies **every single time**, regardless of:
 
@@ -560,11 +578,15 @@ This rule applies **every single time**, regardless of:
 
 ```bash
 git fetch origin
-git rebase origin/<target-branch>     # resolve conflicts locally, never push a conflicted branch
+git rebase --autostash origin/<target-branch>     # resolve conflicts locally, never push a conflicted branch
 git push --force-with-lease            # only if the branch existed remotely before the rebase
 # ...only THEN run the PR-creation tool of your choice
 ```
 
+`--autostash` stashes uncommitted changes before the rebase and re-applies them afterwards, so a dirty working tree does not stop the rebase before it starts. If re-applying them conflicts, git leaves them in the stash and says so; report that before going further.
+
+**Keep the PR body safe across a halted rebase:** never create a PR whose body is empty. A flow that drafts the body before its pre-PR rebase must write the PR body file before the rebase (`<git-dir>/arcane-pr-body.md`, resolved with `git rev-parse --git-dir`; the `.git` directory is never committed and a rebase does not touch it), so a rebase that halts cannot lose it. A flow that builds the body afterwards, from the rebased commit log, must check the file when it reaches the PR-creation step and rebuild it if it is missing or empty — that is the case a halted-then-resumed flow lands in. Enforcement: structured spell gate (ARC-023) — `spell-commit-work` writes the file at Step 9a2, before its Step 9b rebase, and its raw-CLI paths (Steps 9d/9e) refuse a missing or empty file; `spell-create-pull-request` Step 5 refuses a missing or empty file and sends the agent back to its Step 4. No executable check verifies that a created PR's description is non-empty: `spell-create-pull-request`'s post-create read-back is the only re-check, and it is a spell step too.
+
 If a rebase produces conflicts the agent cannot confidently resolve, **STOP** and hand off to the human — do **not** open the PR and hope reviewers will sort it out. Pushing a branch that will produce a merge conflict on the target is a governance violation and wastes reviewer time.
 
 The `spell-create-pull-request` spell encodes this check in Step 0, but the guard is on **the agent**, not on the spell. Bypassing the spell (by calling `az repos pr create` / `gh pr create` directly) does **not** bypass this rule.

package/dist/assets/.arcane/governance/naming-conventions.md

@@ -2,7 +2,7 @@
 title: Naming Conventions
 audience: both
 last_updated: YYYY-MM-DD
-status: active
+status: template
 distributable: true
 tags: [naming, convention, machines, agents, identity]
 ---

package/dist/assets/.arcane/governance/spell-authoring-standards.md

@@ -173,6 +173,46 @@ Arcane spells ship to other repositories and, eventually, open source. Keep them
 > never candidates for that scan regardless of this clause, and no check specifically verifies the
 > carve-out itself.**
 
+### Runtime placeholders (ARC-051)
+
+A `{UPPER_SNAKE}` token in a shipped governance document is one of two kinds
+([ARC-051](https://github.com/codemagicianhq/arcane/blob/main/DECISIONS.md#arc-051--placeholder-taxonomy-for-governance-documents)):
+
+- **Runtime-resolved:** an agent resolves it when it uses the document, from the source named in the
+  list below; if that source is unset, it asks (the resolution rule above). These tokens are legal in a
+  `status: active` document, and the list below is the only place they are enumerated.
+- **Fill-in:** a slot the operator replaces by hand. A document built around such slots carries
+  `status: template` (for example `agent-approved-paths.md` and `naming-conventions.md`), and the
+  placeholder check skips it.
+
+A token that is neither is **unknown**: a typo, or a slot nobody filled. To make a new token legal,
+add it to the list in the same form: one item per token, a code span holding the token first, then
+where it resolves from. The list is read by machine, so keep it between the two markers.
+
+<!-- runtime-placeholders:start -->
+- `{ADO_ORG}` — the Azure DevOps organization: `tracking.ado.org` in the PRD frontmatter or `.arcane.json` ([[development-methodology]]).
+- `{ADO_PROJECT}` — the Azure DevOps project: `tracking.ado.project`, from the same places.
+- `{AGENT_EMAIL}` — the acting agent's commit email: the agent roster ([[agent-policies]]); ask if unset.
+- `{AGENT_NAME}` — the acting agent's name: the agent roster ([[agent-policies]]); ask if unset.
+- `{BUSINESS_NAME}` — the business or venture the work is for: the project's own context (its README or PRD frontmatter); ask if unset.
+- `{HOST}` — the hostname of the machine being configured: the machine itself.
+- `{LLC_NAME}` — the operator's legal entity: the project's own context; ask if unset.
+- `{OPERATOR_DOMAIN}` — the domain the operator uses for agent and tool Git identities: ask if unset.
+- `{OPERATOR_EMAIL}` — the operator's email: `git config user.email`.
+- `{OPERATOR_NAME}` — the operator's name: `git config user.name`.
+- `{OPERATOR_USERNAME}` — the operator's account on the host: the machine itself.
+- `{ORG}` — the organization or owner that hosts the repositories: the repository's remote URL.
+- `{PUBLIC_VISIBILITY_PREDICATE}` — the application's own public-visibility rule: the codebase (WD-07 in [[web-discoverability-standards]]).
+- `{THE_REAL_VALUE}` — a secret's real value in an uncommitted `.env` example: the operator's secret store; never a committed file.
+<!-- runtime-placeholders:end -->
+
+**Enforcement: executable check (ARC-023) — in an installed repository, `spell doctor` warns (never
+fails; the exit code is unchanged) on each token in a `status: active` `.arcane/governance/` document
+that is not in this list, naming the file; it skips the check when this list is not installed. In
+Arcane's own repository, a test (`test/up02-d-runtime-placeholders.test.ts`) fails when a shipped
+`status: active` governance document uses a token that is not in this list. Whether an agent actually
+resolves a listed token from the named source is explicitly advisory prose: no check exercises it.**
+
 ## How to audit a spell
 
 For each dimension, score Bronze/Silver/Gold with one line of evidence. Record the overall (weakest)

package/dist/assets/.arcane/governance/universal-agent-rules.md

@@ -99,7 +99,7 @@ See also: [[README]], [[DECISIONS]], [[governance/git-conventions|Git Convention
     - This is a governance default, not an access control. It constrains what
       agents *write down*; it does not restrict what they may read, and it is
       not a substitute for repository permissions or the push-safety controls in
-      `git-conventions.md`.
+      `git-conventions.md#push-safety` (the "Push safety" section).
     - Absent or `"standard"` means normal behaviour — this rule adds nothing.
 
 ---

package/dist/assets/.arcane/spells/_fragments/push-policy-check.md

@@ -0,0 +1,7 @@
+**Push-policy check (ARC-049) — before any push.** Read `push_policy` from the repository's `.arcane.json` at the repository root (a self-hosted source repository with no root manifest keeps it in `src/assets/.arcane.json` when that file declares `selfHosted: true`). An absent file or an absent field means `open`. The check covers every push this spell makes: a branch push, a `--force-with-lease` push, and a remote branch deletion (`git push <remote> --delete <branch>`).
+- **`open` or absent:** proceed with the push.
+- **`guarded`:** before the push, state the policy ("This repository's push policy is `guarded`: every push needs your explicit confirmation."), name the remote, the branch and the kind of push, and ask the operator for explicit confirmation. Push only on an explicit operator confirmation of that push. A timeout, a cancellation, a delegated or host-generated response, or assent given to something else is not confirmation. **In an autonomous run with no operator to ask, do not push:** report the push as pending operator confirmation, naming the branch and the commits it would carry. This fails closed.
+- **`blocked`:** do not attempt the push. Say why: the repository's push policy is recorded as `blocked`, so pushes are refused on purpose. Name `spell unblock-push` as the only way to lift it, run by the operator from an interactive terminal. Never run it yourself, and never work around the block (`--no-verify`, another remote or URL, editing git config or `.arcane.json`).
+- **Any other value, or a `.arcane.json` that cannot be parsed:** do not push. Report what was found and suggest `spell doctor`.
+- When a push does not happen, skip every step that depends on it (opening or updating a PR, remote branch cleanup) and report the commits as committed locally and not pushed.
+- Enforcement: structured spell gate (ARC-023) — for `guarded`, this check is the only thing that holds a push for confirmation. A `blocked` push is also refused by the pre-push hook and the sentinel push URL that `spell init` or `spell block-push` install, and `spell doctor` reports a `blocked` policy whose controls are missing.

package/dist/assets/.arcane/spells/spell-address-review.md

@@ -100,9 +100,21 @@ Resolve threads via the provider:
 ## Step 6 — Sweep, push, report
 
 1. Re-fetch threads; resolve any still-active ones (this is the merge gate on many providers). Any thread that genuinely cannot be auto-resolved (see Step 5) is reported as "needs manual resolution," not silently left open.
-2. `git push` all commits.
-3. Print a summary table of actions taken (category, file, action, commit), thread status (resolved / deferred-with-TODO / needs manual resolution), commits pushed, and next steps (CI, notify reviewer, ready for re-review).
-4. Optionally post the summary back to the PR as a top-level comment for a durable record.
+2. Before pushing, run the push-policy check:
+
+   <!-- fragment:push-policy-check:start -->
+   **Push-policy check (ARC-049) — before any push.** Read `push_policy` from the repository's `.arcane.json` at the repository root (a self-hosted source repository with no root manifest keeps it in `src/assets/.arcane.json` when that file declares `selfHosted: true`). An absent file or an absent field means `open`. The check covers every push this spell makes: a branch push, a `--force-with-lease` push, and a remote branch deletion (`git push <remote> --delete <branch>`).
+   - **`open` or absent:** proceed with the push.
+   - **`guarded`:** before the push, state the policy ("This repository's push policy is `guarded`: every push needs your explicit confirmation."), name the remote, the branch and the kind of push, and ask the operator for explicit confirmation. Push only on an explicit operator confirmation of that push. A timeout, a cancellation, a delegated or host-generated response, or assent given to something else is not confirmation. **In an autonomous run with no operator to ask, do not push:** report the push as pending operator confirmation, naming the branch and the commits it would carry. This fails closed.
+   - **`blocked`:** do not attempt the push. Say why: the repository's push policy is recorded as `blocked`, so pushes are refused on purpose. Name `spell unblock-push` as the only way to lift it, run by the operator from an interactive terminal. Never run it yourself, and never work around the block (`--no-verify`, another remote or URL, editing git config or `.arcane.json`).
+   - **Any other value, or a `.arcane.json` that cannot be parsed:** do not push. Report what was found and suggest `spell doctor`.
+   - When a push does not happen, skip every step that depends on it (opening or updating a PR, remote branch cleanup) and report the commits as committed locally and not pushed.
+   - Enforcement: structured spell gate (ARC-023) — for `guarded`, this check is the only thing that holds a push for confirmation. A `blocked` push is also refused by the pre-push hook and the sentinel push URL that `spell init` or `spell block-push` install, and `spell doctor` reports a `blocked` policy whose controls are missing.
+   <!-- fragment:push-policy-check:end -->
+
+3. `git push` all commits.
+4. Print a summary table of actions taken (category, file, action, commit), thread status (resolved / deferred-with-TODO / needs manual resolution), commits pushed, and next steps (CI, notify reviewer, ready for re-review).
+5. Optionally post the summary back to the PR as a top-level comment for a durable record.
 
 ## Rules
 

package/dist/assets/.arcane/spells/spell-check-drift.md

@@ -51,6 +51,7 @@ Concrete detectors to run (in addition to general contradiction/stale-date check
   - If normalized content differs, report **real content drift** with normal severity grading.
   - If normalized content matches, report **line-ending-only drift** separately. Do not count these paths as real content findings and do not include them in severity totals or the Go / No-Go decision.
   - Report exact path counts for both classes. Never summarize all byte-different files as content drift.
+- **Unfilled governance placeholders** (ARC-051) — `spell doctor` owns this check: it warns on each `{UPPER_SNAKE}` token in a `status: active` `.arcane/governance/` document that is not in the runtime-placeholders list in `spell-authoring-standards.md`, and skips `status: template` documents. Run `spell doctor` and report each file and token its "Governance placeholders (ARC-051)" row names as a **Low** finding; do not re-implement the scan here. If `spell doctor` cannot run, or reports that check as skipped, say so in the report and move on.
 - **Hub-artifact leak (non-hub repos)** — if `.arcane.json` does not have `role: "hub"`, the existence of any `{BUSINESS_ROOT}/*/IDEAS.md`, `{BUSINESS_ROOT}/*/TODO.md`, or `{BUSINESS_ROOT}/registry.json` (resolve `{BUSINESS_ROOT}` the same way as above -- a consumer repo can still have a configured `business_root` left over from a prior role change, so this must not skip resolution just because the repo isn't currently a hub) is **Critical**: hub-only artifacts (potentially including sibling-venture and portfolio data) do not belong in a repo that isn't a declared hub. This check is deliberately structural (file existence only) — a non-hub repo cannot safely hold the sibling-name list a content-level check would need, so that asymmetry is by design, not a gap.
 - **Hub role/registry consistency (hub repos only)** — when `.arcane.json` has `role: "hub"`:
   - `role: "hub"` with no `{BUSINESS_ROOT}` directory (default `ventures/`) present — **High**: the manifest claims a role the repo can't actually fulfill.

package/dist/assets/.arcane/spells/spell-close-session.md

@@ -149,6 +149,18 @@ Rules:
    - Timeout, cancellation, fallback, or delegated response is not approval. Print the visible authorization downgrade and halt without committing.
 
    c. **Push and open a PR through `spell-commit-work` step 9, including its separate merge gate:**
+   - Run the push-policy check before the push. `spell-commit-work` step 9a runs the same check; run it once per push, not twice. It also governs step 10's remote branch deletions. If it stops the push, end the session with the commits local and report them in the PR Readiness section as not pushed.
+
+     <!-- fragment:push-policy-check:start -->
+     **Push-policy check (ARC-049) — before any push.** Read `push_policy` from the repository's `.arcane.json` at the repository root (a self-hosted source repository with no root manifest keeps it in `src/assets/.arcane.json` when that file declares `selfHosted: true`). An absent file or an absent field means `open`. The check covers every push this spell makes: a branch push, a `--force-with-lease` push, and a remote branch deletion (`git push <remote> --delete <branch>`).
+     - **`open` or absent:** proceed with the push.
+     - **`guarded`:** before the push, state the policy ("This repository's push policy is `guarded`: every push needs your explicit confirmation."), name the remote, the branch and the kind of push, and ask the operator for explicit confirmation. Push only on an explicit operator confirmation of that push. A timeout, a cancellation, a delegated or host-generated response, or assent given to something else is not confirmation. **In an autonomous run with no operator to ask, do not push:** report the push as pending operator confirmation, naming the branch and the commits it would carry. This fails closed.
+     - **`blocked`:** do not attempt the push. Say why: the repository's push policy is recorded as `blocked`, so pushes are refused on purpose. Name `spell unblock-push` as the only way to lift it, run by the operator from an interactive terminal. Never run it yourself, and never work around the block (`--no-verify`, another remote or URL, editing git config or `.arcane.json`).
+     - **Any other value, or a `.arcane.json` that cannot be parsed:** do not push. Report what was found and suggest `spell doctor`.
+     - When a push does not happen, skip every step that depends on it (opening or updating a PR, remote branch cleanup) and report the commits as committed locally and not pushed.
+     - Enforcement: structured spell gate (ARC-023) — for `guarded`, this check is the only thing that holds a push for confirmation. A `blocked` push is also refused by the pre-push hook and the sentinel push URL that `spell init` or `spell block-push` install, and `spell doctor` reports a `blocked` policy whose controls are missing.
+     <!-- fragment:push-policy-check:end -->
+
    - Commit approval is not merge approval.
    - Never invoke merge, auto-complete, or `--status completed` below loader-validated Magus authority.
    - Missing/invalid authority visibly downgrades to PR creation only and requires human completion.

package/dist/assets/.arcane/spells/spell-commit-work.md

@@ -158,19 +158,35 @@ Workflow:
 
    **Separate merge authorization gate:** commit approval never authorizes merge. Bind any interactive merge approval to the exact PR ID and current head SHA, and re-check both immediately before completion. Missing/changed approval invalidates the gate. Never invoke merge, auto-merge, auto-complete, or `--status completed` below loader-validated Magus authority; create/update the PR, print the visible downgrade, and leave completion to a human.
 
-   a. Run `git push origin <branch>`.
+   a. **Push-policy check, then push.** Run this check before the push below. It also governs every later push in this step and in Step 10: the step 9b `--force-with-lease` push and `git push origin --delete <branch>`.
+
+   <!-- fragment:push-policy-check:start -->
+   **Push-policy check (ARC-049) — before any push.** Read `push_policy` from the repository's `.arcane.json` at the repository root (a self-hosted source repository with no root manifest keeps it in `src/assets/.arcane.json` when that file declares `selfHosted: true`). An absent file or an absent field means `open`. The check covers every push this spell makes: a branch push, a `--force-with-lease` push, and a remote branch deletion (`git push <remote> --delete <branch>`).
+   - **`open` or absent:** proceed with the push.
+   - **`guarded`:** before the push, state the policy ("This repository's push policy is `guarded`: every push needs your explicit confirmation."), name the remote, the branch and the kind of push, and ask the operator for explicit confirmation. Push only on an explicit operator confirmation of that push. A timeout, a cancellation, a delegated or host-generated response, or assent given to something else is not confirmation. **In an autonomous run with no operator to ask, do not push:** report the push as pending operator confirmation, naming the branch and the commits it would carry. This fails closed.
+   - **`blocked`:** do not attempt the push. Say why: the repository's push policy is recorded as `blocked`, so pushes are refused on purpose. Name `spell unblock-push` as the only way to lift it, run by the operator from an interactive terminal. Never run it yourself, and never work around the block (`--no-verify`, another remote or URL, editing git config or `.arcane.json`).
+   - **Any other value, or a `.arcane.json` that cannot be parsed:** do not push. Report what was found and suggest `spell doctor`.
+   - When a push does not happen, skip every step that depends on it (opening or updating a PR, remote branch cleanup) and report the commits as committed locally and not pushed.
+   - Enforcement: structured spell gate (ARC-023) — for `guarded`, this check is the only thing that holds a push for confirmation. A `blocked` push is also refused by the pre-push hook and the sentinel push URL that `spell init` or `spell block-push` install, and `spell doctor` reports a `blocked` policy whose controls are missing.
+   <!-- fragment:push-policy-check:end -->
+
+   When the check allows it, run `git push origin <branch>`.
 
    a1. **MCP fail-fast / fallback.** If an MCP tool used anywhere in this step (e.g. `create_pull_request`) fails abnormally once — a hang, an idle-timeout abort, a transport error, or an empty response where data is clearly expected — treat that server as down for the rest of this session. Do not retry it blindly; fall back to the raw CLI paths below (`gh pr create` / `az repos pr create`) and report the downgrade. Full rule: `.arcane/governance/git-conventions.md` → Known issues.
 
+   a2. **Write the PR body file first.** Before step 9b — the first step here that can halt — write the PR description to a file, so a rebase that stops (a conflict, a hand-off to `spell-sync-pull-request`, a resumed session) cannot lose it. Resolve the path with `git rev-parse --git-dir` (it handles worktrees) and write `<git-dir>/arcane-pr-body.md`, following the quality rules in 9f, with the first line `<!-- arcane-pr-body: <current-branch> -->` naming the branch it was written for; this is the same file `spell-create-pull-request` Step 4 writes. The `.git` directory is never committed and a rebase does not touch it, so the file survives a halted rebase. Confirm it is non-empty before continuing. If you delegate the PR to `spell-create-pull-request`, it writes this file itself at its Step 4.
+
    b. **🛑 Mandatory pre-PR rebase (governance guard, applies to every path below).** Before invoking any PR-creation command — whether via `spell-create-pull-request`, raw `gh pr create`, raw `az repos pr create`, or an MCP `create_pull_request` tool — you MUST:
 
    ```bash
    git fetch origin
-   git rebase origin/<target-branch>   # default: main
+   git rebase --autostash origin/<target-branch>   # default: main
    # resolve conflicts locally; never open a PR on a branch that will conflict with target
    git push --force-with-lease         # only if the branch already existed on origin
    ```
 
+   `--autostash` stashes any uncommitted change before the rebase and re-applies it afterwards, so a dirty tree does not stop the rebase before it starts. If the re-apply itself conflicts, git keeps the change in the stash and says so; report that and do not open the PR.
+
    This is not optional. Skipping the rebase (for example by shelling out to `az repos pr create` directly and hoping reviewers will merge over the conflict) is a governance violation. See `.arcane/governance/git-conventions.md` → **🛑 Agent-mandatory pre-PR guard**. If a rebase produces conflicts you cannot confidently resolve, **STOP** and hand off to the human — do not open the PR.
 
    Prefer delegating to `spell-create-pull-request`, which encodes this check as its Step 0.6. The steps below are the raw-CLI fallback and still require the rebase above to have already been performed.
@@ -180,7 +196,8 @@ Workflow:
    - `dev.azure.com` / `visualstudio.com` → Azure DevOps flow
 
    d. **GitHub flow (when remote is GitHub):**
-   - Create PR with `gh pr create --title "<Conventional Commits title>" --body-file <pr-body-file.md>`.
+   - **Refuse to create the PR if the body file is missing, empty, or written for another branch.** Check `<git-dir>/arcane-pr-body.md` (step 9a2) exists, has content, and its first line names the current branch; if not, stop, rewrite it per 9a2, and only then continue. Never fall back to an empty or placeholder `--body`.
+   - Create PR with `gh pr create --title "<Conventional Commits title>" --body-file <git-dir>/arcane-pr-body.md`.
    - Use `--body-file` (not inline `--body`) to preserve multi-line markdown reliably.
    - Assign reviewer by default (operator/reviewer identity) if available.
    - Self-approve only when platform/policy allows. If blocked by policy, report and continue with human approval required.
@@ -190,9 +207,10 @@ Workflow:
    - Check if an active PR already exists for the source branch:
      - `az repos pr list --source-branch <branch> --status active --output json`
      - If one exists, reuse it; otherwise create via `az repos pr create`.
+   - **Refuse to create the PR if the body file is missing, empty, or written for another branch.** Check `<git-dir>/arcane-pr-body.md` (step 9a2) exists, has content, and its first line names the current branch before `az repos pr create`; if not, stop, rewrite it per 9a2, and only then continue.
    - For multi-line markdown descriptions:
-     - Bash: `--description "$(cat <pr-body-file.md>)"`
-     - PowerShell: `--description (Get-Content -Raw .\<pr-body-file.md>)`
+     - Bash: `--description "$(cat <git-dir>/arcane-pr-body.md)"`
+     - PowerShell: `--description (Get-Content -Raw <git-dir>\arcane-pr-body.md)`
    - Assign reviewer by default to the operator/reviewer identity (for example from `git config user.email`), idempotently (skip if already assigned).
    - Approve via CLI first: `az repos pr set-vote --id <PR_ID> --vote approve`.
    - If self-approval is blocked by policy, report that a second human approval is required and continue without forcing approval.

package/dist/assets/.arcane/spells/spell-create-pull-request.md

@@ -51,7 +51,7 @@ Before enabling auto-complete/auto-merge or completing an existing PR, resolve `
 > **🛑 AGENT-MANDATORY PRE-PR CHECKLIST — READ FIRST.** Before *any* PR-creation call (this spell, raw `az repos pr create`, raw `gh pr create`, the `create_pull_request` MCP tool, REST, web hook, or anything else):
 >
 > 1. `git fetch origin`
-> 2. `git rebase origin/<target-branch>` (default `main`) and resolve conflicts locally
+> 2. `git rebase --autostash origin/<target-branch>` (default `main`) and resolve conflicts locally
 > 3. `git push --force-with-lease` if the branch was already on origin
 > 4. *Then* run the PR-creation call
 >
@@ -59,10 +59,22 @@ Before enabling auto-complete/auto-merge or completing an existing PR, resolve `
 
 1. Run `git branch --show-current`. **STOP** if on `main`/`master` — you cannot PR the integration branch into itself. Also **STOP** if detached HEAD (empty output) — check out a named branch first.
 2. **Verify the target exists:** `git rev-parse --verify origin/<target>`. If it fails, `git fetch origin <target>`; if still missing, **STOP** and ask the user for the correct `--target`.
-3. **Ensure the branch is on origin (upstream):** if `git rev-parse --abbrev-ref --symbolic-full-name @{u}` fails, the branch was never pushed — run `git push -u origin <branch>`. The provider CLIs can only open a PR for a branch that exists on the remote.
+3. **Ensure the branch is on origin (upstream):** run the push-policy check below before any push in this Step 0 — this item's `git push -u` and item 6's `--force-with-lease` push. If it stops a push, stop the spell: a PR cannot be opened for a branch the remote does not have.
+
+   <!-- fragment:push-policy-check:start -->
+   **Push-policy check (ARC-049) — before any push.** Read `push_policy` from the repository's `.arcane.json` at the repository root (a self-hosted source repository with no root manifest keeps it in `src/assets/.arcane.json` when that file declares `selfHosted: true`). An absent file or an absent field means `open`. The check covers every push this spell makes: a branch push, a `--force-with-lease` push, and a remote branch deletion (`git push <remote> --delete <branch>`).
+   - **`open` or absent:** proceed with the push.
+   - **`guarded`:** before the push, state the policy ("This repository's push policy is `guarded`: every push needs your explicit confirmation."), name the remote, the branch and the kind of push, and ask the operator for explicit confirmation. Push only on an explicit operator confirmation of that push. A timeout, a cancellation, a delegated or host-generated response, or assent given to something else is not confirmation. **In an autonomous run with no operator to ask, do not push:** report the push as pending operator confirmation, naming the branch and the commits it would carry. This fails closed.
+   - **`blocked`:** do not attempt the push. Say why: the repository's push policy is recorded as `blocked`, so pushes are refused on purpose. Name `spell unblock-push` as the only way to lift it, run by the operator from an interactive terminal. Never run it yourself, and never work around the block (`--no-verify`, another remote or URL, editing git config or `.arcane.json`).
+   - **Any other value, or a `.arcane.json` that cannot be parsed:** do not push. Report what was found and suggest `spell doctor`.
+   - When a push does not happen, skip every step that depends on it (opening or updating a PR, remote branch cleanup) and report the commits as committed locally and not pushed.
+   - Enforcement: structured spell gate (ARC-023) — for `guarded`, this check is the only thing that holds a push for confirmation. A `blocked` push is also refused by the pre-push hook and the sentinel push URL that `spell init` or `spell block-push` install, and `spell doctor` reports a `blocked` policy whose controls are missing.
+   <!-- fragment:push-policy-check:end -->
+
+   Then, if `git rev-parse --abbrev-ref --symbolic-full-name @{u}` fails, the branch was never pushed — run `git push -u origin <branch>`. The provider CLIs can only open a PR for a branch that exists on the remote.
 4. **STOP** if the branch has no commits ahead of the target: `git log origin/<target>..HEAD --oneline` is empty → nothing to PR.
 5. Check for an existing **open** PR for this branch (provider-specific, Step 2). If one exists, print its URL and stop — never create duplicates.
-6. **Mandatory rebase on target (governance guard):** `git fetch origin` then `git rebase origin/<target>`. On clean rebase, `git push --force-with-lease` (only if the branch existed remotely before the rebase). On conflicts: **STOP**, list conflicting files, ask the user to resolve **or run `spell-sync-pull-request`** — it draws the same mechanical-vs-ambiguous conflict line this guard doesn't attempt to, with a recoverable ref before it touches anything; never push a branch that will produce a merge conflict on the target (see git-conventions "🛑 Agent-mandatory pre-PR guard"). This step is not optional and is not skippable by calling a different PR-creation tool.
+6. **Mandatory rebase on target (governance guard):** `git fetch origin` then `git rebase --autostash origin/<target>`. `--autostash` carries any uncommitted change through the rebase instead of refusing to start; if re-applying it conflicts, git keeps it in the stash — report that and stop. On clean rebase, `git push --force-with-lease` (only if the branch existed remotely before the rebase). On conflicts: **STOP**, list conflicting files, ask the user to resolve **or run `spell-sync-pull-request`** — it draws the same mechanical-vs-ambiguous conflict line this guard doesn't attempt to, with a recoverable ref before it touches anything; never push a branch that will produce a merge conflict on the target (see git-conventions "🛑 Agent-mandatory pre-PR guard"). This step is not optional and is not skippable by calling a different PR-creation tool.
 7. **Auto-suggest `--docs-only`** (only if not already passed): if every changed file vs target is documentation/session files (`*.md`, `TODO.md`, `DECISIONS.md`, `journal/**`, `IDEAS.md`, `FEEDBACK.md`), print a one-line hint suggesting `--docs-only` and proceed with the standard path.
 
 ## Step 1 — Gather context
@@ -102,7 +114,7 @@ Format: `type(scope): summary`
 
 ## Step 4 — Build the description
 
-Write the body to a **temp file** and pass it to the provider CLI by file reference — never pass multiline content as a shell argument (this avoids shell/PowerShell truncation, quoting, and newline-mangling). Resolve the scratch path with `git rev-parse --git-dir` (handles worktrees and non-default `.git` locations) and write to `<git-dir>/arcane-pr-body.md`. The `.git` directory is never committed, so the body file is safe and ignored. Delete it after a successful create (Step 6).
+Write the body to a **temp file** and pass it to the provider CLI by file reference — never pass multiline content as a shell argument (this avoids shell/PowerShell truncation, quoting, and newline-mangling). Resolve the scratch path with `git rev-parse --git-dir` (handles worktrees and non-default `.git` locations) and write to `<git-dir>/arcane-pr-body.md`, with the first line `<!-- arcane-pr-body: <current-branch> -->` naming the branch it was written for (a leftover body from another branch in the same checkout must never be reused). The `.git` directory is never committed, so the body file is safe and ignored. Delete it after a successful create (Step 6).
 
 Standard template:
 
@@ -169,6 +181,8 @@ so they need no edit.
 
 ## Step 5 — Create the PR
 
+**Refuse to create the PR if the body file is missing, empty, or written for another branch.** Before either create command, check that `<git-dir>/arcane-pr-body.md` exists, has content, and its first line names the current branch. If it does not — most often because a halted rebase interrupted the flow and it was resumed here — stop and run Step 4 first, then return to this step. Never fall back to an empty or placeholder description.
+
 - **GitHub:**
   ```bash
   gh pr create --title "<title>" --body-file <temp> --base <target> --head <branch> [--draft] [--reviewer <r1,r2>]
@@ -219,6 +233,7 @@ so they need no edit.
 - Never create duplicate PRs — always check first (Step 2).
 - Never push directly to `main` — the PR is the only path.
 - Always write the description to a file before passing it to the provider CLI.
+- Never create a PR whose body file is missing or empty (Step 5) — rebuild it with Step 4 first.
 - Respect the repo merge strategy in `.arcane/governance/git-conventions.md` — **do not squash** (it breaks per-commit attribution).
 - Print the PR URL clearly so it can be recorded by `spell-ship` / `spell-close-session`.
 - Never include secrets or tokens in the title or description.

package/dist/assets/.arcane/spells/spell-manifest.md

@@ -84,7 +84,9 @@ This confirmation covers ordinary destinations only — it never authorizes a di
 
 ## Step 5 — Disclosure Gate
 
-Any destination whose repo has `visibility: "public"` — (a) or (d) landing in a public repo, or (c) filing a tracker item in a public tracker (a GitHub issue on a public repo is exactly as much a disclosure as its `IDEAS.md`) — is a disclosure, never covered by `all`, `go`, or any other batch confirmation. Per entry, print the **exact text** that will become public and ask for the literal word `disclose`. Anything else skips that one entry (it stays `status: new`) without aborting the rest of the batch.
+The gate is **keyed on the destination repository's visibility, never on the destination letter**. An entry is a disclosure when the repository its text would land in — that repo's tree, its tracker, or anything else it publishes — has `visibility: "public"` in the registry, whatever route puts it there. There is deliberately no list of covered destinations: an enumerated list is how a route slips through. A PRD scaffold (b) writes the idea text into the public repo's tree, so it is a disclosure; so is a tracker item filed on a public repo (a GitHub issue on a public repo is exactly as much a disclosure as its `IDEAS.md`), and so is any destination added to Step 4 later. If the destination repository's visibility is missing from the registry, treat it as public.
+
+A disclosure is never covered by `all`, `go`, or any other batch confirmation. Per entry, print the **exact text** that will become public and ask for the literal word `disclose`. Anything else skips that one entry (it stays `status: new`) without aborting the rest of the batch. **Enforcement: structured spell gate (ARC-023) — a public-destination entry is written only after the operator's own literal `disclose` for that entry; a timeout, cancellation, or host-generated fallback is not consent and skips the entry.**
 
 On a repo's first-ever disclosure (its `IDEAS.md` has no existing entries with a `promoted → public:` marker), offer to add this boundary statement to that file's header in the same staged change:
 
@@ -110,13 +112,15 @@ hub:TODO.md
 book:<other-slug>/IDEAS.md
 ```
 
+Any marker whose destination repository is public ends in ` (disclosed)` — whichever route landed it, because Step 5 gated it as a disclosure.
+
 Dropped entries get `<!-- status: dropped YYYY-MM-DD -->`, optionally with a trailing `(reason)`.
 
 Before any downstream write, grep the target file for the entry's normalized first ~40 characters — if already present, treat this entry as already-landed, mark the hub entry promoted, and skip the write. This is what makes an interrupted or re-run batch safe.
 
 ## Step 7 — Leak Scan
 
-Before writing outbound text to any consumer or public destination, scan it for:
+Before writing outbound text to any consumer or public destination, scan it. Outbound text is the idea text **and the entry's tag** (`[#tag]`): the tag travels with the entry into whatever the destination copies it into (an `IDEAS.md` line, a tracker label or title), so a tag is outbound text like any other. **Enforcement: structured spell gate (ARC-023) — a hit in either field blocks that entry's write until the operator rewrites it or keeps it in the book.** Scan both for:
 
 - Every other venture's slug and aliases from the registry (never the destination's own)
 - Hub path fragments (`{BUSINESS_ROOT}` paths, this repo's own root-relative paths)
@@ -141,7 +145,7 @@ Run spell-commit-work in each repo. N entries remain new.
 ## Rules
 
 - Never run outside a hub repo. Never infer hub status.
-- Never let `all` or the plan-confirm authorize a disclosure — that confirmation is always separate, always per-entry, always the literal word `disclose`.
+- A disclosure is any entry whose destination repository is public, whatever the destination (Step 5). Never let `all` or the plan-confirm authorize a disclosure — that confirmation is always separate, always per-entry, always the literal word `disclose`.
 - Never write a sibling venture's slug, a hub path, or a machine name into a consumer or public artifact — the leak scan is mandatory, not advisory.
 - Never commit. Stage and report; hand off to `spell-commit-work`.
 - Never guess a venture from partial input — resolve through the registry's aliases or ask.

package/dist/assets/.arcane/spells/spell-save-idea.md

@@ -58,7 +58,10 @@ When targeting a venture book that doesn't exist yet as a file, create it from t
 - Strip a leading invocation phrase if the user dictated one (e.g., "save this idea —", "note that", "remind me to") — log the idea, not the command to log it.
 - Lightly clean it up: fix obvious typos and capitalization, but **do not** rewrite, expand, or editorialize. The user's phrasing is the record.
 - If the idea is clearly multiple distinct ideas, split them into separate entries (one appended line each).
-- Optionally infer a single short tag (1–2 words, kebab-case) from the content — e.g., `ui`, `infra`, `marketing`, `dx`. If nothing fits cleanly, omit the tag.
+- Optionally infer a single short tag (1–2 words, kebab-case) from the content. Where the tag comes from depends on `.arcane.json`'s optional `idea_tags` field, `{ "mode": "extend" | "replace", "tags": [...] }`:
+  - **`idea_tags` declared:** pick the tag from the declared vocabulary and never invent a tag outside it. `mode: "extend"` — the vocabulary is the declared `tags` plus today's free-form default tags: prefer a declared tag when one fits, otherwise infer one as below. `mode: "replace"` — the declared `tags` are the whole vocabulary; no free-form tag is inferred. If nothing in the vocabulary fits cleanly, omit the tag.
+  - **No `idea_tags`:** infer a free-form tag from the content — e.g., `ui`, `infra`, `marketing`, `dx`. If nothing fits cleanly, omit the tag.
+  - A tag must never carry a venture, client, or person name — tag the idea's subject (`ui`, `billing`), never whose it is. A tag travels with the entry when `spell-manifest` promotes it downstream, so a name in a tag leaks exactly as a name in the text would. **Enforcement: explicitly advisory prose (ARC-023) — the agent's judgment at capture time; in a hub, `spell-manifest`'s leak scan re-checks the tag before it leaves, but only for sibling venture names, hub paths, machine names and the org-token denylist.**
 - **If the idea contains a secret** (token, password, API key, connection string), redact it inline (e.g., `[redacted]`) before writing and warn the user in the confirmation. Never write the raw value to `IDEAS.md`.
 
 ## Step 2 — Append to IDEAS.md
@@ -114,4 +117,5 @@ Do not ask follow-up questions. Do not commit — leave that to `spell-commit-wo
 - Never rewrite the user's idea beyond light cleanup. Preserve their words.
 - No approval gate — write immediately.
 - Never include secrets, tokens, or credentials in an entry.
+- Never put a venture, client, or person name in a tag; when `.arcane.json` declares `idea_tags`, draw the tag from that vocabulary (Step 1).
 - Do not commit the change.

package/dist/assets/.arcane/spells/spell-ship.md

@@ -38,7 +38,19 @@ Workflow:
    - Merge the target branch into the current branch (e.g. `git merge origin/<target>`).
    - **On merge conflicts:** STOP and ask the user to resolve them, or run `spell-sync-pull-request` — it handles exactly this case, with a recoverable ref and an explicit mechanical-vs-ambiguous conflict boundary. Do not attempt to auto-resolve here.
    - After a clean merge (or once the user has resolved conflicts), re-run the full test suite and confirm it passes.
-   - Push the synced branch (e.g. `git push`).
+   - Before pushing, run the push-policy check. It also governs step 9's remote branch deletion.
+
+     <!-- fragment:push-policy-check:start -->
+     **Push-policy check (ARC-049) — before any push.** Read `push_policy` from the repository's `.arcane.json` at the repository root (a self-hosted source repository with no root manifest keeps it in `src/assets/.arcane.json` when that file declares `selfHosted: true`). An absent file or an absent field means `open`. The check covers every push this spell makes: a branch push, a `--force-with-lease` push, and a remote branch deletion (`git push <remote> --delete <branch>`).
+     - **`open` or absent:** proceed with the push.
+     - **`guarded`:** before the push, state the policy ("This repository's push policy is `guarded`: every push needs your explicit confirmation."), name the remote, the branch and the kind of push, and ask the operator for explicit confirmation. Push only on an explicit operator confirmation of that push. A timeout, a cancellation, a delegated or host-generated response, or assent given to something else is not confirmation. **In an autonomous run with no operator to ask, do not push:** report the push as pending operator confirmation, naming the branch and the commits it would carry. This fails closed.
+     - **`blocked`:** do not attempt the push. Say why: the repository's push policy is recorded as `blocked`, so pushes are refused on purpose. Name `spell unblock-push` as the only way to lift it, run by the operator from an interactive terminal. Never run it yourself, and never work around the block (`--no-verify`, another remote or URL, editing git config or `.arcane.json`).
+     - **Any other value, or a `.arcane.json` that cannot be parsed:** do not push. Report what was found and suggest `spell doctor`.
+     - When a push does not happen, skip every step that depends on it (opening or updating a PR, remote branch cleanup) and report the commits as committed locally and not pushed.
+     - Enforcement: structured spell gate (ARC-023) — for `guarded`, this check is the only thing that holds a push for confirmation. A `blocked` push is also refused by the pre-push hook and the sentinel push URL that `spell init` or `spell block-push` install, and `spell doctor` reports a `blocked` policy whose controls are missing.
+     <!-- fragment:push-policy-check:end -->
+
+   - Push the synced branch (e.g. `git push`) only when the check allows it. If it stops the push, the ship is blocked until the operator confirms (`guarded`) or lifts the policy (`blocked`); record that in the ship report.
 
 3. **Run pre-deploy checklist**:
    - [ ] All CI pipeline checks pass (build, test, lint, security scan).

package/dist/assets/.arcane/spells/spell-sync-pull-request.md

@@ -111,6 +111,18 @@ recoverable ref from Step 1 is still available.
 
 ## Step 5 — Push and verify
 
+Run the push-policy check first. If it stops the push, stop here: the rebased branch stays local, the recoverable ref from Step 1 still points at the pre-sync state, and Step 6's report never runs — report the stop instead.
+
+<!-- fragment:push-policy-check:start -->
+**Push-policy check (ARC-049) — before any push.** Read `push_policy` from the repository's `.arcane.json` at the repository root (a self-hosted source repository with no root manifest keeps it in `src/assets/.arcane.json` when that file declares `selfHosted: true`). An absent file or an absent field means `open`. The check covers every push this spell makes: a branch push, a `--force-with-lease` push, and a remote branch deletion (`git push <remote> --delete <branch>`).
+- **`open` or absent:** proceed with the push.
+- **`guarded`:** before the push, state the policy ("This repository's push policy is `guarded`: every push needs your explicit confirmation."), name the remote, the branch and the kind of push, and ask the operator for explicit confirmation. Push only on an explicit operator confirmation of that push. A timeout, a cancellation, a delegated or host-generated response, or assent given to something else is not confirmation. **In an autonomous run with no operator to ask, do not push:** report the push as pending operator confirmation, naming the branch and the commits it would carry. This fails closed.
+- **`blocked`:** do not attempt the push. Say why: the repository's push policy is recorded as `blocked`, so pushes are refused on purpose. Name `spell unblock-push` as the only way to lift it, run by the operator from an interactive terminal. Never run it yourself, and never work around the block (`--no-verify`, another remote or URL, editing git config or `.arcane.json`).
+- **Any other value, or a `.arcane.json` that cannot be parsed:** do not push. Report what was found and suggest `spell doctor`.
+- When a push does not happen, skip every step that depends on it (opening or updating a PR, remote branch cleanup) and report the commits as committed locally and not pushed.
+- Enforcement: structured spell gate (ARC-023) — for `guarded`, this check is the only thing that holds a push for confirmation. A `blocked` push is also refused by the pre-push hook and the sentinel push URL that `spell init` or `spell block-push` install, and `spell doctor` reports a `blocked` policy whose controls are missing.
+<!-- fragment:push-policy-check:end -->
+
 ```bash
 git push --force-with-lease
 ```