failproofai 1.0.7-beta.1 → 1.0.7

package/src/hooks/pack-store.ts

@@ -35,17 +35,8 @@
 import { createHash } from "node:crypto";
 import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { dirname, resolve } from "node:path";
-import {
-  MAX_SEMANTIC_POLICIES_PER_PACK,
-  PACK_COMMIT_RE,
-  checkPackMinCliVersion,
-  packsRoot,
-  parsePackIdentity,
-  parsePackPolicy,
-  parsePackSemanticPolicy,
-  readInstalledPacks,
-} from "./pack-manifest";
-import type { ResolvedPack, SemanticManifestEntry } from "./pack-manifest";
+import { PACK_COMMIT_RE, packsRoot, parsePackIdentity, parsePackPolicy, readInstalledPacks } from "./pack-manifest";
+import type { ResolvedPack } from "./pack-manifest";
 import type { InstalledPackRecord } from "./pack-manifest";
 import type { PolicyCatalogEntry } from "./policy-types";
 import type { PolicyEffect } from "./cloud-managed-policies";
@@ -95,13 +86,6 @@ export interface AddPackResult {
   selection: SelectionReason;
   /** Category slugs the pack offers, for `--category`. */
   categories: string[];
-  /**
-   * How many Jev question sets came with it, and not a list of names: they are
-   * not selectable and not switchable, so a name here would invite a `--policy`
-   * that cannot work. A non-zero count is what stops a semantic-only install
-   * reporting "the pack is installed and enforcing nothing".
-   */
-  semantic: number;
   artifact: string;
 }
 
@@ -470,10 +454,6 @@ interface FetchedPack {
   id: string;
   version: string;
   policies: PolicyCatalogEntry[];
-  /** The pack's Jev question sets, validated. Empty when it declares none. */
-  semantic: SemanticManifestEntry[];
-  /** The minimum CLI it claims, once this one has been checked against it. */
-  minCliVersion?: string;
   effect?: PolicyEffect;
   /** The git commit the publisher built this from, when they had one. */
   commit?: string;
@@ -481,66 +461,6 @@ interface FetchedPack {
   artifactDigest: string;
 }
 
-/**
- * The shape both fetch paths read a manifest's `semantic` array through.
- *
- * REFUSES what the loader would only drop, and the asymmetry is the same one
- * `parsePackPolicy` already has on this path: nothing has been written yet, so
- * refusing costs the user a clear error message and the publisher a fix —
- * whereas dropping an entry here would install a pack that enforces less than
- * the preview just showed, with the difference recorded only in a hook log. The
- * loader drops instead because by then the pack IS installed and refusing it
- * denies every tool call its regex policies cover.
- *
- * The per-pack cap is checked for the same reason. Over it, the loader keeps the
- * first 24 in declared order and records the rest as dropped; letting that
- * happen silently at install time means a machine quietly running a subset of
- * what the user agreed to.
- *
- * The CHARACTER budget is deliberately not checked here. It lives in
- * `semantic/pack-policies.ts`, and importing that module would pull Jev's
- * sixteen prompts into this one — which is reachable from a Next.js server
- * action (`app/actions/pack-actions.ts`), not just from the CLI. `failproofai
- * publish` refuses an over-budget pack at build time, and a pack built by some
- * other tool has its overflow dropped at resolve time with a recorded reason.
- */
-function parseManifestSemantic(packId: string, value: unknown): SemanticManifestEntry[] {
-  if (value === undefined) return [];
-  if (!Array.isArray(value)) throw new Error(`pack ${packId} semantic is not an array`);
-  if (value.length > MAX_SEMANTIC_POLICIES_PER_PACK) {
-    throw new Error(
-      `pack ${packId} declares ${value.length} semantic policies, over the cap of ${MAX_SEMANTIC_POLICIES_PER_PACK}`,
-    );
-  }
-  const entries = value.map((entry, i) => parsePackSemanticPolicy(packId, entry, i));
-  const names = new Set<string>();
-  for (const entry of entries) {
-    if (names.has(entry.name)) throw new Error(`pack ${packId} declares semantic policy ${entry.name} twice`);
-    names.add(entry.name);
-  }
-  return entries;
-}
-
-/**
- * Refuse a pack this CLI is too old to run — HERE, where the message is
- * something the person who typed the command can act on.
- *
- * The loader refuses it too, and that refusal is the fail-closed one: on a
- * machine where it lands, every tool call the pack's policies cover is denied
- * until somebody works out why. Catching it at install turns the same fact into
- * one line at the moment of choosing.
- *
- * A minimum this build cannot compare is IGNORED, exactly as the loader ignores
- * it: a publisher's typo in a version string must not be able to stop anyone
- * installing a pack. `failproofai publish` refuses to write one, so this is
- * only reachable from a pack built by some other tool.
- */
-function assertMinCliVersion(packId: string, declared: unknown): string | undefined {
-  const verdict = checkPackMinCliVersion(packId, declared);
-  if (verdict.kind === "too-old") throw new Error(verdict.reason);
-  return verdict.kind === "satisfied" ? verdict.declared : undefined;
-}
-
 /** Fetch and fully validate a pack, without writing anything. */
 /**
  * The short names for the pack Failproof AI publishes.
@@ -623,19 +543,6 @@ export interface PackPreview {
   /** The git commit the publisher built this from, when they had one. */
   commit?: string;
   policies: PolicyCatalogEntry[];
-  /**
-   * The pack's Jev question sets. Shown, not selectable: a pack's `enabled`
-   * narrowing picks which of its REGEX policies register, and its semantic set
-   * replaces this build's wholesale or not at all.
-   *
-   * Carried on the preview because the preview is what somebody consents to. A
-   * pack that quietly brings sixteen new questions to the classifier — and
-   * replaces the sixteen this build shipped — is not something to discover after
-   * installing it.
-   */
-  semantic: SemanticManifestEntry[];
-  /** The minimum CLI this pack declares, when it declares one this build can read. */
-  minCliVersion?: string;
   /** The exact source the preview was read from, tag resolved and pinned. */
   source: string;
   /** True when the tag was resolved rather than typed. */
@@ -682,52 +589,22 @@ export async function fetchPackPreview(source: string): Promise<PackPreview> {
   if (!raw || typeof raw !== "object") throw new Error(`${PACK_MANIFEST_ASSET} is not an object`);
   const value = raw as {
     id?: unknown; version?: unknown; policies?: unknown; effect?: unknown; commit?: unknown;
-    semantic?: unknown; minCliVersion?: unknown;
   };
   const identity = parsePackIdentity(value);
-  const minCliVersion = assertMinCliVersion(identity.id, value.minCliVersion);
-  const semantic = parseManifestSemantic(identity.id, value.semantic);
-  const policies = parseManifestPolicies(identity.id, value.policies);
-  assertDeclaresSomething(policies, semantic);
+  if (!Array.isArray(value.policies) || value.policies.length === 0) {
+    throw new Error("pack manifest declares no policies");
+  }
   return {
     id: identity.id,
     version: identity.version,
     effect: identity.effect,
     ...(identity.commit ? { commit: identity.commit } : {}),
-    policies,
-    semantic,
-    ...(minCliVersion ? { minCliVersion } : {}),
+    policies: value.policies.map((policy, i) => parsePackPolicy(identity.id, policy, i)),
     source: formatPackSpec(spec),
     resolvedFromLatest,
   };
 }
 
-/**
- * The regex half of a manifest. ABSENT is an empty list, not an error: a pack of
- * Jev questions alone is a legitimate thing to publish now, and ours writes
- * `policies: []` for one. Present and not an array is still malformed.
- */
-function parseManifestPolicies(packId: string, value: unknown): PolicyCatalogEntry[] {
-  if (value === undefined) return [];
-  if (!Array.isArray(value)) throw new Error(`pack ${packId} policies is not an array`);
-  return value.map((policy, i) => parsePackPolicy(packId, policy, i));
-}
-
-/**
- * A pack has to bring SOMETHING, and either half counts.
- *
- * It used to be "at least one regex policy", which made a pack of Jev questions
- * alone impossible to install — and that is a legitimate pack: the regex floor
- * may already be somebody else's, and the two halves version independently. This
- * is the same widening `build()` makes to its "registered no policies" refusal,
- * so the two ends of the lane agree on what an empty pack is.
- */
-function assertDeclaresSomething(policies: PolicyCatalogEntry[], semantic: SemanticManifestEntry[]): void {
-  if (policies.length === 0 && semantic.length === 0) {
-    throw new Error("pack manifest declares no policies");
-  }
-}
-
 /**
  * The record this install is really an update OF — matched by id, or failing
  * that by artifact digest.
@@ -770,26 +647,20 @@ async function fetchPack(spec: PinnedPackSpec): Promise<FetchedPack> {
   if (!parsed || typeof parsed !== "object") throw new Error(`${PACK_MANIFEST_ASSET} is not an object`);
   const raw = parsed as {
     id?: unknown; version?: unknown; policies?: unknown; effect?: unknown; commit?: unknown;
-    semantic?: unknown; minCliVersion?: unknown;
   };
   const identity = parsePackIdentity(raw);
-  // Before the shape checks below, because being too old for the pack is not a
-  // complaint about the pack: the message to give is "update the CLI", and a
-  // manifest field this build cannot read yet must not be reported as malformed.
-  const minCliVersion = assertMinCliVersion(identity.id, raw.minCliVersion);
+  if (!Array.isArray(raw.policies) || raw.policies.length === 0) {
+    throw new Error("pack manifest declares no policies");
+  }
   // Validated with the SAME rules the loader applies, so a pack that could never
   // load is refused here — while nothing has been written — rather than
   // installing cleanly and failing silently on the next tool call.
-  const policies = parseManifestPolicies(identity.id, raw.policies);
-  const semantic = parseManifestSemantic(identity.id, raw.semantic);
-  assertDeclaresSomething(policies, semantic);
+  const policies = raw.policies.map((p, i) => parsePackPolicy(identity.id, p, i));
 
   return {
     id: identity.id,
     version: identity.version,
     policies,
-    semantic,
-    ...(minCliVersion ? { minCliVersion } : {}),
     ...(raw.effect !== undefined ? { effect: identity.effect } : {}),
     ...(identity.commit ? { commit: identity.commit } : {}),
     artifact,
@@ -1060,22 +931,6 @@ export async function addPack(
     entry: artifactRel,
     sha256: fetched.artifactDigest,
     policies: fetched.policies,
-    // Both halves of the manifest reach the record, because `installed.json` is
-    // the only thing enforcement reads. Left off, a pack's Jev questions were
-    // fetched, verified, shown in the preview and then dropped on the floor: the
-    // resolver found no `semantic` on any installed pack, kept this build's
-    // compiled set, and every pack policy naming one of the pack's own checks in
-    // `reviewedBy` registered as hard. Nothing failed, and the half the user
-    // installed did nothing.
-    //
-    // Omitted when empty for the same reason the manifest omits it: an empty
-    // array reads as "this pack declares semantic entries", and the replacement
-    // rule would then have it replace the compiled-in set with nothing.
-    ...(fetched.semantic.length > 0 ? { semantic: fetched.semantic } : {}),
-    // Recorded so the READER re-checks it. This CLI has already satisfied it or
-    // refused the install, but the record outlives this CLI: a downgrade, or a
-    // machine restored from another's home directory, has to meet it again.
-    ...(fetched.minCliVersion ? { minCliVersion: fetched.minCliVersion } : {}),
     // Provenance, carried through from the manifest so `policies` and the
     // dashboard can say which source produced what is installed. NOT part of
     // verification — `sha256` above is the pin, and this is a label beside it.
@@ -1123,7 +978,6 @@ export async function addPack(
     available,
     selection: reason,
     categories: [...new Set(fetched.policies.map((p) => slugifyCategory(p.category)))],
-    semantic: fetched.semantic.length,
     artifact: artifactAbs,
   };
 }

package/src/hooks/policy-catalog.ts

@@ -25,12 +25,6 @@
  * - **Absent optionals stay absent.** `beta`, `alwaysOn` and `params` are read
  *   with `in` and `undefined` checks; default-filling them changes behaviour and
  *   fails existing tests.
- * - **Every entry states its `authority`,** even though absent already means
- *   `hard`: whether Jev may clear a builtin's verdict is a decision to make per
- *   policy, not a default to inherit. `reviewable` only where a semantic policy
- *   genuinely covers the same concern, named in `reviewedBy`. The table and the
- *   reasoning are in `docs/policies/authority.mdx`; `alwaysOn` is hard whatever
- *   it says here.
  *
  * `params.default` values are handed to policies BY REFERENCE, so this must stay
  * one module-level const — never a factory minting fresh defaults per call.
@@ -44,7 +38,6 @@ export const POLICY_CATALOG: PolicyCatalogEntry[] = [
     displayTitle: "Redacted JWT tokens from tool output",
     impact: "Stops the agent from echoing auth tokens it saw in command output.",
     match: { events: ["PostToolUse"] },
-    authority: "hard",
     defaultEnabled: true,
     category: "Sanitize",
   },
@@ -54,7 +47,6 @@ export const POLICY_CATALOG: PolicyCatalogEntry[] = [
     displayTitle: "Redacted API keys from tool output",
     impact: "Catches OpenAI / Anthropic / GitHub / AWS / Stripe / Google keys before the model sees them.",
     match: { events: ["PostToolUse"] },
-    authority: "hard",
     defaultEnabled: true,
     category: "Sanitize",
     params: {
@@ -71,7 +63,6 @@ export const POLICY_CATALOG: PolicyCatalogEntry[] = [
     displayTitle: "Redacted database connection strings from tool output",
     impact: "Strips embedded DB credentials before they reach the model context.",
     match: { events: ["PostToolUse"] },
-    authority: "hard",
     defaultEnabled: true,
     category: "Sanitize",
   },
@@ -81,7 +72,6 @@ export const POLICY_CATALOG: PolicyCatalogEntry[] = [
     displayTitle: "Redacted PEM private keys from tool output",
     impact: "Prevents private key bodies from being echoed into chat context.",
     match: { events: ["PostToolUse"] },
-    authority: "hard",
     defaultEnabled: true,
     category: "Sanitize",
   },
@@ -91,7 +81,6 @@ export const POLICY_CATALOG: PolicyCatalogEntry[] = [
     impact: "Strips Authorization: Bearer values before they hit the model.",
     description: "Stop Claude from reading Authorization Bearer tokens in tool responses",
     match: { events: ["PostToolUse"] },
-    authority: "hard",
     defaultEnabled: true,
     category: "Sanitize",
   },
@@ -101,8 +90,6 @@ export const POLICY_CATALOG: PolicyCatalogEntry[] = [
     impact: "Env vars often contain secrets; blocking `env` / `printenv` keeps them out of the model context.",
     description: "Prevent commands that read environment variables",
     match: { events: ["PreToolUse"], toolNames: ["Bash"] },
-    authority: "reviewable",
-    reviewedBy: ["env-secrets-dump", "secret-exposure"],
     defaultEnabled: true,
     category: "Environment",
   },
@@ -112,8 +99,6 @@ export const POLICY_CATALOG: PolicyCatalogEntry[] = [
     impact: "`.env` files routinely contain API keys and DB credentials.",
     description: "Block reading/writing .env files",
     match: { events: ["PreToolUse"] },
-    authority: "reviewable",
-    reviewedBy: ["secret-exposure"],
     defaultEnabled: true,
     category: "Environment",
   },
@@ -123,8 +108,6 @@ export const POLICY_CATALOG: PolicyCatalogEntry[] = [
     impact: "Stops the agent from peeking at neighboring repos or your home directory.",
     description: "Block file reads outside the session working directory",
     match: { events: ["PreToolUse"], toolNames: ["Read", "Glob", "Grep", "Bash"] },
-    authority: "reviewable",
-    reviewedBy: ["read-outside-workspace"],
     defaultEnabled: false,
     category: "Environment",
     params: {
@@ -143,7 +126,6 @@ export const POLICY_CATALOG: PolicyCatalogEntry[] = [
     // PermissionRequest is Codex's escalation-approval event; fire the same
     // sudo guard there so Codex sandbox bypasses are blocked too.
     match: { events: ["PreToolUse", "PermissionRequest"], toolNames: ["Bash"] },
-    authority: "hard",
     defaultEnabled: true,
     category: "Dangerous Commands",
     params: {
@@ -160,7 +142,6 @@ export const POLICY_CATALOG: PolicyCatalogEntry[] = [
     impact: "`curl ... | sh` runs unverified remote code on your machine.",
     description: "Block piping downloads to shell",
     match: { events: ["PreToolUse"], toolNames: ["Bash"] },
-    authority: "hard",
     defaultEnabled: true,
     category: "Dangerous Commands",
   },
@@ -170,7 +151,6 @@ export const POLICY_CATALOG: PolicyCatalogEntry[] = [
     impact: "Catches catastrophic `rm -rf /` and Windows equivalents.",
     description: "Prevent catastrophic deletions",
     match: { events: ["PreToolUse"], toolNames: ["Bash"] },
-    authority: "hard",
     defaultEnabled: false,
     category: "Dangerous Commands",
     params: {
@@ -200,7 +180,6 @@ export const POLICY_CATALOG: PolicyCatalogEntry[] = [
     },
     defaultEnabled: true,
     alwaysOn: true,
-    authority: "hard",
     category: "Dangerous Commands",
   },
   {
@@ -209,7 +188,6 @@ export const POLICY_CATALOG: PolicyCatalogEntry[] = [
     impact: "kubectl can change live cluster state — gated unless allow-listed.",
     description: "Block kubectl commands (Kubernetes cluster mutations)",
     match: { events: ["PreToolUse"], toolNames: ["Bash"] },
-    authority: "hard",
     defaultEnabled: false,
     category: "Infra Commands",
     params: {
@@ -226,7 +204,6 @@ export const POLICY_CATALOG: PolicyCatalogEntry[] = [
     impact: "Terraform mutates real infrastructure — gated unless allow-listed.",
     description: "Block terraform and tofu (OpenTofu) commands",
     match: { events: ["PreToolUse"], toolNames: ["Bash"] },
-    authority: "hard",
     defaultEnabled: false,
     category: "Infra Commands",
     params: {
@@ -243,7 +220,6 @@ export const POLICY_CATALOG: PolicyCatalogEntry[] = [
     impact: "AWS CLI can spend money or break prod — gated.",
     description: "Block aws CLI commands",
     match: { events: ["PreToolUse"], toolNames: ["Bash"] },
-    authority: "hard",
     defaultEnabled: false,
     category: "Infra Commands",
     params: {
@@ -260,7 +236,6 @@ export const POLICY_CATALOG: PolicyCatalogEntry[] = [
     impact: "gcloud can spend money or break prod — gated.",
     description: "Block gcloud (Google Cloud) CLI commands",
     match: { events: ["PreToolUse"], toolNames: ["Bash"] },
-    authority: "hard",
     defaultEnabled: false,
     category: "Infra Commands",
     params: {
@@ -277,7 +252,6 @@ export const POLICY_CATALOG: PolicyCatalogEntry[] = [
     impact: "az can spend money or break prod — gated.",
     description: "Block az (Azure) CLI commands",
     match: { events: ["PreToolUse"], toolNames: ["Bash"] },
-    authority: "hard",
     defaultEnabled: false,
     category: "Infra Commands",
     params: {
@@ -294,7 +268,6 @@ export const POLICY_CATALOG: PolicyCatalogEntry[] = [
     impact: "Helm releases mutate cluster state — gated.",
     description: "Block helm commands",
     match: { events: ["PreToolUse"], toolNames: ["Bash"] },
-    authority: "hard",
     defaultEnabled: false,
     category: "Infra Commands",
     params: {
@@ -311,7 +284,6 @@ export const POLICY_CATALOG: PolicyCatalogEntry[] = [
     impact: "Catches `gh workflow run`, `gh pr merge`, `gh secret set`, etc.",
     description: "Block gh CLI pipeline-trigger subcommands (workflow run, run rerun/cancel, pr merge, release create/delete, cache delete, secret set/delete)",
     match: { events: ["PreToolUse"], toolNames: ["Bash"] },
-    authority: "hard",
     defaultEnabled: false,
     category: "Infra Commands",
     params: {
@@ -328,7 +300,6 @@ export const POLICY_CATALOG: PolicyCatalogEntry[] = [
     impact: "Stops the agent from creating `.pem`, `id_rsa`, `credentials.json`, etc.",
     description: "Block writing secret key files",
     match: { events: ["PreToolUse"], toolNames: ["Write"] },
-    authority: "hard",
     defaultEnabled: false,
     category: "Dangerous Commands",
     params: {
@@ -345,7 +316,6 @@ export const POLICY_CATALOG: PolicyCatalogEntry[] = [
     impact: "Direct pushes to a protected branch bypass review.",
     description: "Block pushing to main/master",
     match: { events: ["PreToolUse"], toolNames: ["Bash"] },
-    authority: "hard",
     defaultEnabled: true,
     category: "Git",
     params: {
@@ -362,7 +332,6 @@ export const POLICY_CATALOG: PolicyCatalogEntry[] = [
     impact: "Force-pushes rewrite history and can clobber teammates' work.",
     description: "Prevent force-pushing to any branch",
     match: { events: ["PreToolUse"], toolNames: ["Bash"] },
-    authority: "hard",
     defaultEnabled: false,
     category: "Git",
   },
@@ -372,21 +341,6 @@ export const POLICY_CATALOG: PolicyCatalogEntry[] = [
     impact: "Work should land via PR — direct commits skip review.",
     description: "Block git commits and merges on main/master branch",
     match: { events: ["PreToolUse"], toolNames: ["Bash"] },
-    // Hard, although `commit-on-protected-branch` covers exactly this concern.
-    // That check is `mode: "instruct"`, and an instruct-mode reviewer can never
-    // answer deny — so the conjunction had one reachable outcome, cleared, and
-    // marking this reviewable did not hand the decision to Jev. It switched the
-    // policy off on every machine that configured Jev, while the mark said
-    // otherwise.
-    //
-    // The test that matters is not "can the reviewer keep this block" but "is
-    // there anything left that can deny". `block-read-outside-cwd` also has only
-    // an instruct reviewer and stays reviewable, because when it clears,
-    // `secret-exposure` and `credential-exfiltration` are still asked about the
-    // same read and still deny on their own through the most-severe merge. Here
-    // nothing else covers committing on a protected branch, so a clear leaves
-    // the concern unenforced by anything.
-    authority: "hard",
     defaultEnabled: false,
     category: "Git",
     params: {
@@ -403,8 +357,6 @@ export const POLICY_CATALOG: PolicyCatalogEntry[] = [
     impact: "Amending after a push rewrites history that others may have pulled.",
     description: "Warns before amending git commits, which rewrites history",
     match: { events: ["PreToolUse"], toolNames: ["Bash"] },
-    authority: "reviewable",
-    reviewedBy: ["git-history-rewrite"],
     defaultEnabled: false,
     category: "Git",
   },
@@ -414,7 +366,6 @@ export const POLICY_CATALOG: PolicyCatalogEntry[] = [
     impact: "Stash deletions are permanent and silent.",
     description: "Warns before permanently deleting stashed changes",
     match: { events: ["PreToolUse"], toolNames: ["Bash"] },
-    authority: "hard",
     defaultEnabled: false,
     category: "Git",
   },
@@ -424,7 +375,6 @@ export const POLICY_CATALOG: PolicyCatalogEntry[] = [
     impact: "Wide stages routinely catch generated files or secrets you didn't intend to commit.",
     description: "Warns before staging all working tree files with git add -A / . / --all",
     match: { events: ["PreToolUse"], toolNames: ["Bash"] },
-    authority: "hard",
     defaultEnabled: false,
     category: "Git",
   },
@@ -434,8 +384,6 @@ export const POLICY_CATALOG: PolicyCatalogEntry[] = [
     impact: "Easy way to wipe a table by accident.",
     description: "Warn before executing destructive SQL (DROP/TRUNCATE/DELETE without WHERE) via database clients",
     match: { events: ["PreToolUse"], toolNames: ["Bash"] },
-    authority: "reviewable",
-    reviewedBy: ["database-destruction"],
     defaultEnabled: false,
     category: "Database",
   },
@@ -445,7 +393,6 @@ export const POLICY_CATALOG: PolicyCatalogEntry[] = [
     impact: "ALTER TABLE operations can lock tables and break readers.",
     description: "Warns before SQL schema changes (ALTER TABLE with column or rename operations)",
     match: { events: ["PreToolUse"], toolNames: ["Bash"] },
-    authority: "hard",
     defaultEnabled: false,
     category: "Database",
   },
@@ -455,7 +402,6 @@ export const POLICY_CATALOG: PolicyCatalogEntry[] = [
     impact: "Publishes are irreversible — `npm publish` / `cargo publish` shouldn't happen without intent.",
     description: "Warn before publishing packages to public registries (npm, PyPI, crates.io, RubyGems, etc.)",
     match: { events: ["PreToolUse"], toolNames: ["Bash"] },
-    authority: "hard",
     defaultEnabled: false,
     category: "Packages & System",
   },
@@ -465,8 +411,6 @@ export const POLICY_CATALOG: PolicyCatalogEntry[] = [
     impact: "`npm i -g`, `cargo install`, `pip --user` pollute your machine outside the project.",
     description: "Warns before installing packages globally (npm -g, cargo install, etc.)",
     match: { events: ["PreToolUse"], toolNames: ["Bash"] },
-    authority: "reviewable",
-    reviewedBy: ["system-modification"],
     defaultEnabled: false,
     category: "Packages & System",
   },
@@ -476,7 +420,6 @@ export const POLICY_CATALOG: PolicyCatalogEntry[] = [
     impact: "Mixing package managers creates lockfile churn for your team.",
     description: "Blocks non-preferred package managers and tells Claude to use an allowed one (e.g., uv instead of pip)",
     match: { events: ["PreToolUse"], toolNames: ["Bash"] },
-    authority: "hard",
     defaultEnabled: false,
     category: "Packages & System",
     params: {
@@ -498,7 +441,6 @@ export const POLICY_CATALOG: PolicyCatalogEntry[] = [
     impact: "Catches accidentally large file writes (logs, binaries, model dumps).",
     description: "Warn before writing files larger than 1MB (configurable via thresholdKb param)",
     match: { events: ["PreToolUse"], toolNames: ["Write"] },
-    authority: "hard",
     defaultEnabled: false,
     category: "Packages & System",
     params: {
@@ -515,7 +457,6 @@ export const POLICY_CATALOG: PolicyCatalogEntry[] = [
     impact: "Catches `nohup` / `&` / `screen` / `tmux` / `disown` patterns that the agent often forgets to clean up.",
     description: "Warns before starting detached or background processes",
     match: { events: ["PreToolUse"], toolNames: ["Bash"] },
-    authority: "hard",
     defaultEnabled: false,
     category: "Packages & System",
   },
@@ -525,7 +466,6 @@ export const POLICY_CATALOG: PolicyCatalogEntry[] = [
     impact: "Usually a sign of a stuck loop burning tokens.",
     description: "Warn when the same tool is called 3+ times with identical parameters",
     match: { events: ["PreToolUse"] },
-    authority: "hard",
     defaultEnabled: false,
     category: "AI Behavior",
   },
@@ -535,7 +475,6 @@ export const POLICY_CATALOG: PolicyCatalogEntry[] = [
     impact: "Work not in a commit is invisible to teammates and easy to lose.",
     description: "Require all changes to be committed before Claude stops",
     match: { events: ["Stop"] },
-    authority: "hard",
     defaultEnabled: false,
     category: "Workflow",
   },
@@ -545,7 +484,6 @@ export const POLICY_CATALOG: PolicyCatalogEntry[] = [
     impact: "Local-only commits won't trigger CI or be reviewable.",
     description: "Require all commits to be pushed to remote before Claude stops",
     match: { events: ["Stop"] },
-    authority: "hard",
     defaultEnabled: false,
     category: "Workflow",
     params: {
@@ -567,7 +505,6 @@ export const POLICY_CATALOG: PolicyCatalogEntry[] = [
     impact: "Branches without PRs don't get reviewed.",
     description: "Require a pull request to exist for the current branch before Claude stops",
     match: { events: ["Stop"] },
-    authority: "hard",
     defaultEnabled: false,
     category: "Workflow",
     params: {
@@ -584,7 +521,6 @@ export const POLICY_CATALOG: PolicyCatalogEntry[] = [
     impact: "Conflicting branches can't merge — surface them early.",
     description: "Require the current branch to merge cleanly with the base branch before Claude stops",
     match: { events: ["Stop"] },
-    authority: "hard",
     defaultEnabled: false,
     category: "Workflow",
     params: {
@@ -601,7 +537,6 @@ export const POLICY_CATALOG: PolicyCatalogEntry[] = [
     impact: "Failing CI blocks deploy.",
     description: "Require CI checks to pass on the current HEAD commit before Claude stops (ignores stale runs on prior commits)",
     match: { events: ["Stop"] },
-    authority: "hard",
     defaultEnabled: false,
     category: "Workflow",
   },