failproofai 1.0.7-beta.2 → 1.0.7

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "failproofai",
-  "version": "1.0.7-beta.2",
-  "description": "Observability and enforcement for AI agent harnesses. 40 built-in policies hooked into 12 of them — Claude Code, Codex, Cursor, Hermes, OpenClaw and more — blocking the tool call before it runs. Local dashboard included, no account needed.",
+  "version": "1.0.7",
+  "description": "Observability and enforcement for AI agent harnesses. 39 built-in policies hooked into 12 of them — Claude Code, Codex, Cursor, Hermes, OpenClaw and more — blocking the tool call before it runs. Local dashboard included, no account needed.",
   "bin": {
     "failproofai": "./dist/cli.mjs",
     "failproofaid": "./bin/failproofaid-shim.mjs"
@@ -122,15 +122,15 @@
     "browserslist": "4.28.8"
   },
   "optionalDependencies": {
-    "@failproofai/failproofaid-linux-x64": "1.0.7-beta.2",
-    "@failproofai/failproofaid-linux-arm64": "1.0.7-beta.2",
-    "@failproofai/failproofaid-darwin-x64": "1.0.7-beta.2",
-    "@failproofai/failproofaid-darwin-arm64": "1.0.7-beta.2"
+    "@failproofai/failproofaid-linux-x64": "1.0.7",
+    "@failproofai/failproofaid-linux-arm64": "1.0.7",
+    "@failproofai/failproofaid-darwin-x64": "1.0.7",
+    "@failproofai/failproofaid-darwin-arm64": "1.0.7"
   },
   "failproofaidBinaries": {
-    "linux-x64": "5362ab6a4cfb23d1eee598aac67aedd9e43351e62724ee1c6b40c4fc8021c08f",
-    "linux-arm64": "f14a2548b41e14ad32b7fdd03a27ffe7160da1046e422e1f651099371b0d27e5",
-    "darwin-x64": "14189cade04f17cf5278bd8061a5ec0c2a2381aa21944ae0d05e8c35b98c2816",
-    "darwin-arm64": "4ba9f5c321894d953407efa3404f0deec07dccfd7db7bc2511bb35226816b583"
+    "linux-x64": "65acfcabaa4dda6d37d2958d4100c366a85f17c68d2250de6126e2717ca773e6",
+    "linux-arm64": "cece883f87d53034003be8f0f293aa89bd0e69306d6032e17b3eb91f230b3ce2",
+    "darwin-x64": "565aa3d560a05dd76e2eb843ddbad593d2d8df94c963bdeb1c7e2a8a3816d0c5",
+    "darwin-arm64": "2b41601b53e77a31439e92d8be9be6b9872e3d4ad7e8664ff89cd2be4ed6c44d"
   }
 }

package/pi-extension/index.ts

@@ -404,17 +404,6 @@ export default function failproofaiBridge(pi: PiExtensionApi) {
       session_id: resolveSessionId(e.sessionId, resolveCwd(e.cwd)),
       cwd: resolveCwd(e.cwd),
       hook_event_name: "UserPromptSubmit",
-      // "interactive" | "rpc" | "extension": which channel the input came
-      // through, and the only mark Pi gives about who wrote the prompt. It
-      // names the channel, not the author — `pi -p "<text>"` reports
-      // `interactive` exactly as a person typing does — so the Jev evaluator
-      // uses it only in the direction it is reliable in (`piMachineTurn`,
-      // src/hooks/semantic/intent.ts): `extension`, another extension's
-      // `sendUserMessage()` whose text can be model-written or repo-derived,
-      // is refused, while `interactive`, `rpc` and an absent value are all
-      // recorded as the human's request. Policies read it too, and a later Pi
-      // build may say more here.
-      input_source: e.source,
     });
     if (decision.block) {
       console.error(`[failproofai] prompt blocked: ${decision.reason ?? "blocked by policy"}`);

package/scripts/build-policy-pack.mjs

@@ -31,24 +31,6 @@
  * that stops an agent disabling failproofai, it ships compiled in, and
  * `pack-manifest.ts` REFUSES any pack that declares `alwaysOn`. A pack containing
  * it would be rejected by our own loader — correctly.
- *
- * **Every policy states its authority** — whether Jev may clear its verdict —
- * as the registry would resolve it (`manifestAuthority`), not as a copy of
- * whatever the catalog happened to spell. A machine running this pack reads
- * authority from the MANIFEST, so a field left off here is a policy that is
- * silently hard everywhere it is installed. The entry passes the same fields to
- * `customPolicies.add`, so a manifest rebuilt from the entry (`failproofai
- * publish`) says the same thing.
- *
- * **It emits no `semantic` array, deliberately.** A pack that declares one
- * REPLACES this build's compiled-in semantic set wholesale
- * (`semantic/pack-policies.ts`), and this pack is the dress rehearsal for the
- * regex floor leaving the package — not for Jev's question set leaving it. So
- * the 39 builtins travel and the 16 semantic policies stay compiled in, which
- * also keeps `manifestAuthority` below judging `reviewedBy` against the right
- * list: the builtin reviewer names, which is what a machine installing this pack
- * will still be running. The separate `FailproofAI/jev-policies` pack is where
- * the semantic half ships, and it declares its own `minCliVersion`.
  */
 import { execFileSync } from "node:child_process";
 import { createHash } from "node:crypto";
@@ -58,7 +40,6 @@ import { fileURLToPath } from "node:url";
 // The one place the pack's id is decided. Imported rather than restated — see
 // PACK_ID below for what restating it cost.
 import { CORE_SOURCE } from "../src/hooks/pack-store.ts";
-import { manifestAuthority } from "../src/hooks/policy-authority.ts";
 
 const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..");
 // `--out <dir>` lets the conformance test generate into a temp directory rather
@@ -114,23 +95,6 @@ for (const policy of BUILTIN_POLICIES) {
     defaultEnabled: policy.defaultEnabled === true,
     match: policy.match,
     fn: policy.fn,
-    // The parameter schema. It has to be registered here as well as written
-    // into the manifest this script builds, because there are TWO manifest
-    // producers for this pack and they have to agree: this script builds one
-    // from POLICY_CATALOG, and the publish command rebuilds one by importing
-    // the entry and reading back what it registered. A field the entry does
-    // not register is a field the second producer cannot know about.
-    //
-    // params is the one that fails silently STRICTER. Registration reads a
-    // pack policy's schema from the manifest, so an absent schema means the
-    // policy sees empty params: block-sudo's allowPatterns, and block-rm-rf's
-    // and block-read-outside-cwd's allowPaths, stop applying -- taking the
-    // user's own configured values with them. No backticks in this comment:
-    // see the note above entrySource.
-    ...(policy.params !== undefined ? { params: policy.params } : {}),
-    // Whether Jev may clear it; see the note on authority at the top.
-    ...(policy.authority !== undefined ? { authority: policy.authority } : {}),
-    ...(policy.reviewedBy !== undefined ? { reviewedBy: policy.reviewedBy } : {}),
   });
 }
 `;
@@ -156,20 +120,7 @@ try {
 // validates these with the loader's own rules, so a shape the loader would
 // refuse fails this build rather than shipping.
 const { POLICY_CATALOG } = await import(join(ROOT, "src/hooks/policy-catalog.ts"));
-const policies = POLICY_CATALOG.filter((p) => !p.alwaysOn).map((p) => {
-  // Throws on a declaration the registry would quietly downgrade: in the
-  // catalog that is a typo or a renamed semantic policy, and publishing it
-  // would turn a reviewed decision into an unannounced hard one. The fields
-  // come from the same call, so the check cannot be skipped without the
-  // manifest losing its authority too.
-  const resolved = manifestAuthority(p);
-  // Spread first so every field keeps its catalog position; only the two
-  // authority fields are replaced by their resolved values.
-  const entry = { ...p, authority: resolved.authority };
-  if (resolved.reviewedBy) entry.reviewedBy = resolved.reviewedBy;
-  else delete entry.reviewedBy;
-  return entry;
-});
+const policies = POLICY_CATALOG.filter((p) => !p.alwaysOn).map((p) => ({ ...p }));
 
 const manifest = JSON.stringify(
   { id: PACK_ID, version, effect: "enforce", policies },
@@ -187,10 +138,8 @@ writeFileSync(
 );
 
 const omitted = POLICY_CATALOG.filter((p) => p.alwaysOn).map((p) => p.name);
-const reviewable = policies.filter((p) => p.authority === "reviewable").length;
 console.log(
-  `[policy-pack] ${PACK_ID}@${version} — ${policies.length} policies ` +
-  `(${reviewable} reviewable by Jev, ${policies.length - reviewable} hard), ` +
+  `[policy-pack] ${PACK_ID}@${version} — ${policies.length} policies, ` +
   `${(entryBytes.length / 1024).toFixed(1)} KB entry` +
   (omitted.length ? `; omitted alwaysOn: ${omitted.join(", ")}` : ""),
 );

package/src/audit/features.ts

@@ -69,13 +69,13 @@ export const ARCHITECT_CAUTION_SIGNALS = new Set(["reread-after-edit", "redundan
 
 /**
  * Mapping from policy/detector short-name → which archetype its hits feed,
- * and how heavily (intensity within the cluster). Every one of the 40 builtin
+ * and how heavily (intensity within the cluster). Every one of the 39 builtin
  * policies and 8 audit-only detectors maps exactly once — no overlaps, full
  * coverage. Weights express *severity within* a persona; cross-persona
  * fairness is handled later by lift normalisation, not by these numbers.
  */
 export const SIGNAL_MAP: Record<string, { archetype: ArchetypeKey; weight: number }> = {
-  // ── cowboy ── destructive / forceful / bypasses guardrails (21) ───────────
+  // ── cowboy ── destructive / forceful / bypasses guardrails (20) ───────────
   "block-rm-rf":               { archetype: "cowboy", weight: 2.0 },
   "block-failproofai-commands":{ archetype: "cowboy", weight: 2.0 },
   "block-sudo":                { archetype: "cowboy", weight: 1.5 },
@@ -88,7 +88,6 @@ export const SIGNAL_MAP: Record<string, { archetype: ArchetypeKey; weight: numbe
   "git-commit-no-verify":      { archetype: "cowboy", weight: 1.5 },
   "warn-git-amend":            { archetype: "cowboy", weight: 0.8 },
   "warn-git-stash-drop":       { archetype: "cowboy", weight: 1.0 },
-  "warn-git-clean":            { archetype: "cowboy", weight: 1.0 },
   "warn-all-files-staged":     { archetype: "cowboy", weight: 0.6 },
   "block-kubectl":             { archetype: "cowboy", weight: 1.5 },
   "block-terraform":           { archetype: "cowboy", weight: 1.5 },

package/src/hooks/builtin-policies.ts

@@ -623,15 +623,8 @@ const GIT_DESTRUCTIVE_SUBCOMMANDS = new Set([
  */
 const GIT_FLAGS_WITH_OPERANDS = new Set(["-C", "-c", "--git-dir", "--work-tree", "--namespace", "--exec-path"]);
 
-/**
- * Where the `git` subcommand sits in `args`, with git's own global options
- * walked off first, or `-1` when there is no subcommand at all.
- *
- * The index rather than the value, because a caller that wants to read the
- * SUBCOMMAND's flags (`warnGitClean`) needs to know where they start, and
- * `args.indexOf("clean")` would land on a `-C clean` operand instead.
- */
-function gitSubcommandIndex(args: string[]): number {
+/** The `git` subcommand, with git's own global options walked off first. */
+function gitSubcommand(args: string[]): string | undefined {
   for (let i = 0; i < args.length; i++) {
     const arg = args[i];
     if (GIT_FLAGS_WITH_OPERANDS.has(arg)) {
@@ -639,15 +632,9 @@ function gitSubcommandIndex(args: string[]): number {
       continue;
     }
     if (arg.startsWith("-")) continue;
-    return i;
+    return arg;
   }
-  return -1;
-}
-
-/** The `git` subcommand, with git's own global options walked off first. */
-function gitSubcommand(args: string[]): string | undefined {
-  const i = gitSubcommandIndex(args);
-  return i < 0 ? undefined : args[i];
+  return undefined;
 }
 
 /**
@@ -1392,48 +1379,6 @@ const GIT_AMEND_RE = /\bgit\s+commit\b.*--amend\b/;
 // warnGitStashDrop
 const GIT_STASH_DROP_RE = /\bgit\s+stash\s+(?:drop|clear)\b/;
 
-// warnGitClean
-/**
- * `git`, however the command line spells it. Same shape as {@link RM_CMD_RE}:
- * an absolute path to the binary does not change what it does.
- */
-const GIT_CMD_RE = /^(?:\/\S*\/)?git$/;
-
-/** A short-flag cluster: `-f`, `-fdx`, `-xdf`. */
-const SHORT_FLAG_CLUSTER_RE = /^-[A-Za-z]+$/;
-
-/**
- * `clean.requireForce=false`, the config that makes `git clean` delete with no
- * `-f` at all — and settable per invocation as `git -c
- * clean.requireForce=false clean -xd`. Reading the subcommand's flags alone
- * would call that "no force, no warning" on the one spelling that needs none.
- */
-const GIT_CLEAN_FORCE_WAIVED_RE = /^clean\.requireforce=(?:false|0|no|off)$/i;
-
-/**
- * The default `destructiveFlags`, and why the condition is these three letters
- * rather than "any `git clean`".
- *
- * `git clean` deletes nothing without `-f` / `--force` (or the config above),
- * and `-n` / `--dry-run` only prints — so force is the precondition and
- * dry-run is the exemption. What force ALONE removes is untracked files in the
- * current directory: the narrowest spelling, and the one people mean when they
- * tidy up. These are the letters that widen the blast radius past that:
- *
- * - `-x` also removes IGNORED files — `.env`, local config, editor state,
- *   scratch work. That is the data that genuinely cannot be rebuilt by running
- *   a command, and it is what makes `git clean -fdx` the severe spelling.
- * - `-X` removes ONLY ignored files: the same loss, tracked tree untouched.
- * - `-d` also removes untracked DIRECTORIES — whole new subtrees git has never
- *   had a copy of.
- *
- * A bare `git clean -f` is deliberately absent. It has the smallest radius and
- * by far the most traffic, and a guard that fires on the ordinary spelling is
- * one people switch off — which would cost them the `-fdx` warning too. Add
- * `"f"` to `destructiveFlags` to opt into it.
- */
-const GIT_CLEAN_DESTRUCTIVE_FLAGS = ["d", "x", "X"];
-
 // warnAllFilesStaged
 const GIT_ADD_ALL_RE = /\bgit\s+add\s+(?:-A\b|--all\b|\.(?:\s|$|;|&&|\|\|))/;
 
@@ -2270,29 +2215,17 @@ const READ_LIKE_CMDS =
  * separator characters that appear in compound argv tokens (':' for Docker
  * volume mounts and PATH-like lists, '=' for env var assignments) so that a
  * suffix like '/dashboard.mdx' in 'docs/STAR/dashboard.mdx' or '/docs' in
- * '-v HOST_DIR:/docs' is not misread as a standalone absolute path. '/' is in
- * that list too, so a match cannot START on the second slash of a protocol
- * separator: 'http://localhost:3000/x' used to yield '/localhost:3000/x'.
- * A match that starts on the FIRST slash is untouched, so '//etc/passwd' —
- * a real, working spelling of /etc/passwd — is still extracted and still
- * resolves to /etc/passwd.
- *
- * Runs of slashes with nothing else ('//', '///') are dropped: those are a
- * line-comment marker, not a directory. They used to resolve to the filesystem
- * root, which denied any read-like command carrying a '// …' comment — a
- * heredoc writing a TypeScript file into the project, say. A lone '/' is the
- * root and is kept.
+ * '-v HOST_DIR:/docs' is not misread as a standalone absolute path.
  */
 function extractAbsolutePaths(command: string): string[] {
   const paths: string[] = [];
-  const pathRe = /(?<![a-zA-Z0-9_.\-~\\*?:=/])(?:~\/[^\s;|&"'()\[\]{}]*|~(?=\s|$|[;|&"'()\[\]{}])|\/[^\s;|&"'()\[\]{}]*)/g;
+  const pathRe = /(?<![a-zA-Z0-9_.\-~\\*?:=])(?:~\/[^\s;|&"'()\[\]{}]*|~(?=\s|$|[;|&"'()\[\]{}])|\/[^\s;|&"'()\[\]{}]*)/g;
 
   function addPaths(s: string): void {
     pathRe.lastIndex = 0;
     let m: RegExpExecArray | null;
     while ((m = pathRe.exec(s)) !== null) {
       let p = m[0];
-      if (/^\/{2,}$/.test(p)) continue; // a `//` comment marker, not the root
       if (p === "~") p = homedir();
       else if (p.startsWith("~/")) p = join(homedir(), p.slice(2));
       paths.push(p);
@@ -2583,101 +2516,6 @@ function warnGitStashDrop(ctx: PolicyContext): PolicyResult {
   return allow();
 }
 
-/** What one `git clean` argument list asks for. */
-interface GitCleanFlags {
-  force: boolean;
-  dryRun: boolean;
-  /** Short-flag letters, with `--force` counted as `f` so widening works either way. */
-  letters: Set<string>;
-}
-
-/**
- * Read `git clean`'s own options: clusters (`-fdx`) and the two long forms
- * that matter (`--force`, `--dry-run`).
- *
- * Everything after `--` is a pathspec, not a flag — `git clean -n -- -fdx`
- * asks about a file literally called `-fdx` and deletes nothing.
- */
-function readGitCleanFlags(args: string[]): GitCleanFlags {
-  const letters = new Set<string>();
-  let force = false;
-  let dryRun = false;
-  let sawEndOfOptions = false;
-  for (const token of args) {
-    if (token === "--") {
-      sawEndOfOptions = true;
-      continue;
-    }
-    if (sawEndOfOptions) continue;
-    if (token === "--force") {
-      force = true;
-      continue;
-    }
-    if (token === "--dry-run") {
-      dryRun = true;
-      continue;
-    }
-    if (token.startsWith("--")) continue;
-    if (!SHORT_FLAG_CLUSTER_RE.test(token)) continue;
-    for (const letter of token.slice(1)) {
-      if (letter === "f") force = true;
-      if (letter === "n") dryRun = true;
-      letters.add(letter);
-    }
-  }
-  if (force) letters.add("f");
-  return { force, dryRun, letters };
-}
-
-/** True when git's own `-c key=value` options waive `clean.requireForce`. */
-function gitCleanForceWaived(globalOptions: string[]): boolean {
-  for (let i = 0; i < globalOptions.length; i++) {
-    const token = globalOptions[i];
-    const value =
-      token === "-c" ? globalOptions[i + 1] : token.startsWith("-c") ? token.slice(2) : undefined;
-    if (value !== undefined && GIT_CLEAN_FORCE_WAIVED_RE.test(value)) return true;
-  }
-  return false;
-}
-
-/**
- * The gap this closes: `git clean -fdx` was caught by NEITHER tier — no regex
- * builtin matched the string at all, and the semantic check that covers
- * unrecoverable deletion cannot fire on it. See the note on the catalog entry
- * for the measurement and for why this policy is `hard`.
- */
-function warnGitClean(ctx: PolicyContext): PolicyResult {
-  if (ctx.toolName !== "Bash") return allow();
-  const destructiveFlags = ((ctx.params?.destructiveFlags ?? GIT_CLEAN_DESTRUCTIVE_FLAGS) as string[]);
-  if (destructiveFlags.length === 0) return allow();
-
-  for (const segment of shellSegments(getCommand(ctx))) {
-    const tokens = parseArgvTokens(segment);
-    // `findIndex`, not `tokens[0]`, so an env prefix (`GIT_DIR=x git clean …`)
-    // and an absolute binary path both still resolve to the git invocation.
-    const gitIdx = tokens.findIndex((t) => GIT_CMD_RE.test(t));
-    if (gitIdx < 0) continue;
-    const args = tokens.slice(gitIdx + 1);
-    const subIdx = gitSubcommandIndex(args);
-    if (subIdx < 0 || args[subIdx] !== "clean") continue;
-
-    const flags = readGitCleanFlags(args.slice(subIdx + 1));
-    // `-n` / `--dry-run` prints what would go and removes nothing, whatever
-    // else is on the line — the safe inspection form, never a warning.
-    if (flags.dryRun) continue;
-    if (!flags.force && !gitCleanForceWaived(args.slice(0, subIdx))) continue;
-    if (!destructiveFlags.some((f) => flags.letters.has(f))) continue;
-
-    return instruct(
-      "STOP: This command deletes untracked files from the working tree (git clean). Git has no copy of " +
-        "untracked or ignored files, so nothing it removes can be recovered: -d takes whole untracked " +
-        "directories, and -x / -X also take .gitignore'd files such as .env, local config and scratch work. " +
-        "Re-run it with --dry-run and confirm the exact paths with the user before executing.",
-    );
-  }
-  return allow();
-}
-
 function warnAllFilesStaged(ctx: PolicyContext): PolicyResult {
   if (ctx.toolName !== "Bash") return allow();
   const cmd = getCommand(ctx);
@@ -3240,7 +3078,7 @@ function requireCiGreenBeforeStop(ctx: PolicyContext): PolicyResult {
  * Each value is the identical hoisted function object, never a wrapper. Two
  * things depend on that and neither fails loudly: `audit/cache.ts` hashes
  * `fn.toString()` into the audit cache's `engineVersion`, so wrapping every
- * entry would collapse 40 distinct hashes into one and freeze the key — stale
+ * entry would collapse 39 distinct hashes into one and freeze the key — stale
  * audit results would then be served for the full 30-day TTL with no symptom;
  * and `gitBranchCache` is module-scoped, so a per-call factory would silently
  * reset it on every hook event.
@@ -3271,7 +3109,6 @@ const POLICY_IMPLEMENTATIONS: Record<string, PolicyFunction> = {
   "block-work-on-main": blockWorkOnMain,
   "warn-git-amend": warnGitAmend,
   "warn-git-stash-drop": warnGitStashDrop,
-  "warn-git-clean": warnGitClean,
   "warn-all-files-staged": warnAllFilesStaged,
   "warn-destructive-sql": warnDestructiveSql,
   "warn-schema-alteration": warnSchemaAlteration,
@@ -3341,13 +3178,7 @@ export function registerBuiltinPolicies(enabledNames: string[]): void {
     // A guard against the agent disabling failproofai that any of those can
     // switch off is not a guard.
     if (policy.alwaysOn || enabledSet.has(normalizePolicyName(policy.name))) {
-      // `alwaysOn` travels with the declaration so the self-protection guard
-      // resolves to hard even if its catalog entry ever said otherwise.
-      registerPolicy(policy.name, policy.description, policy.fn, policy.match, 0, policy.params, {
-        authority: policy.authority,
-        reviewedBy: policy.reviewedBy,
-        alwaysOn: policy.alwaysOn,
-      });
+      registerPolicy(policy.name, policy.description, policy.fn, policy.match, 0, policy.params);
     }
   }
 }

package/src/hooks/cloud-enrollment-cli.ts

@@ -377,7 +377,7 @@ export function versionStatusLines(): string[] {
   const daemon = recorded?.daemon ?? "not installed";
   return [
     `CLI ${cliVersion} · daemon ${daemon}${skew ? " (STALE)" : ""} · layout ${recorded?.layout ?? "-"}`,
-    ...(skew ? ["  Run `failproofai update` to update the daemon."] : []),
+    ...(skew ? ["  Run `failproofai config` to update the daemon."] : []),
   ];
 }
 

package/src/hooks/cloud-managed-policies.ts

@@ -8,8 +8,6 @@ import { createHash } from "node:crypto";
 import { existsSync, readFileSync, realpathSync, rmSync } from "node:fs";
 import { isAbsolute, relative, resolve } from "node:path";
 import { cloudPoliciesDir } from "./fp-home";
-import { authorityFieldsOf } from "./policy-authority";
-import type { PolicyAuthority } from "./policy-types";
 
 /**
  * Active-manifest schema versions this reader accepts.
@@ -46,19 +44,6 @@ export interface CloudManagedPolicyArtifact {
   sha256: string;
   path: string;
   deployment: number;
-  /**
-   * Whether Jev may clear this policy's verdict once it is configured, as the
-   * ASSIGNMENT declares it — code inside the artifact cannot grant itself this.
-   * Absent means `hard`, which is what keeps Jev from weakening central
-   * enforcement by default: a cloud policy is only ever reviewable because
-   * whoever deployed it said so. Applies to every hook the artifact registers.
-   *
-   * Read and validated here; the daemon has to carry it into `active.json`
-   * (`ActivePolicy` in `cloud_policies.rs`) before a deployment can set it.
-   */
-  authority?: PolicyAuthority;
-  /** The semantic policies that must all be asked and none answer `deny`; see `authority`. */
-  reviewedBy?: string[];
 }
 
 interface ActiveManifest {
@@ -70,8 +55,6 @@ interface ActiveManifest {
     effect?: string;
     sha256: string;
     path: string;
-    authority?: unknown;
-    reviewedBy?: unknown;
   }>;
 }
 
@@ -223,11 +206,6 @@ export function readActiveCloudManagedPolicies(): CloudManagedPolicyArtifact[] {
       sha256: policy.sha256,
       path,
       deployment: manifest.deployment,
-      // Unlike `effect`, a malformed authority is dropped rather than refused:
-      // dropping it makes this policy `hard`, the default that keeps enforcing,
-      // while refusing would take the whole deployment down over an optional
-      // field. Absent stays absent.
-      ...authorityFieldsOf(policy as unknown as Record<string, unknown>),
     };
   });
 }

package/src/hooks/custom-hooks-loader.ts

@@ -33,7 +33,6 @@ import type { CustomHook, PolicyCatalogEntry } from "./policy-types";
 import type { CloudManagedPolicyArtifact } from "./cloud-managed-policies";
 import type { ResolvedPack } from "./pack-manifest";
 import { customPoliciesDir, shimsDir } from "./fp-home";
-import { warnAuthority, withMergedAuthority } from "./policy-authority";
 
 const LOADING_KEY = "__FAILPROOFAI_LOADING_HOOKS__";
 
@@ -449,19 +448,9 @@ export async function loadAllCustomHooks(
       `cloud-managed policies ${existing.id} and ${policy.id} have identical source, so they share ` +
         `one artifact and load as one policy; enforcing it if either asks to enforce`,
     );
-    // Authority resolves toward HARD, for the same reason: reviewable only if
-    // every assignment behind these bytes says so. Keeping one record's
-    // declaration let the order of active.json decide, so a team's reviewable
-    // assignment could clear what an org-wide hard one enforces.
-    const winner = existing.effect !== "enforce" && policy.effect === "enforce" ? policy : existing;
-    const { merged, overruled } = withMergedAuthority(winner, [existing, policy]);
-    if (overruled) {
-      warnAuthority(
-        `cloud-managed policies ${existing.id} and ${policy.id} share one artifact and do not all declare it ` +
-          `reviewable, so it stays hard`,
-      );
+    if (existing.effect !== "enforce" && policy.effect === "enforce") {
+      cloudManagedByPath.set(key, policy);
     }
-    cloudManagedByPath.set(key, merged);
   }
 
   // Installed packs, keyed by artifact path — the same content-addressing, and
@@ -493,34 +482,14 @@ export async function loadAllCustomHooks(
    *
    * Winner precedence on a name both declare, because the merged record carries
    * the winner's id and version and there is no merging two different defaults.
-   *
-   * Except AUTHORITY, which resolves toward hard like the effect resolves toward
-   * enforce (`withMergedAuthority`): a name is reviewable only if every pack
-   * behind the artifact declares it reviewable. A pack whose manifest does not
-   * list the name at all counts as hard — its copy of the artifact registers
-   * the policy all the same, undeclared, and an undeclared pack policy is hard.
-   * Winner precedence here would let one pack's manifest make another pack's
-   * policy reviewable, which is the one thing a manifest may never do.
    */
   const unionCatalog = (
     winner: PolicyCatalogEntry[],
     other: PolicyCatalogEntry[],
-  ): { policies: PolicyCatalogEntry[]; overruled: string[] } => {
-    /** Names a pack asked to be reviewable and did not get, for the warning. */
-    const overruled: string[] = [];
-    const harden = (entry: PolicyCatalogEntry, peer: PolicyCatalogEntry | undefined) => {
-      const r = withMergedAuthority(entry, [entry, peer ?? {}]);
-      if (r.overruled) overruled.push(entry.name);
-      return r.merged;
-    };
-    return {
-      policies: [
-        ...winner.map((w) => harden(w, other.find((p) => p.name === w.name))),
-        ...other.filter((p) => !winner.some((w) => w.name === p.name)).map((p) => harden(p, undefined)),
-      ],
-      overruled,
-    };
-  };
+  ): PolicyCatalogEntry[] => [
+    ...winner,
+    ...other.filter((p) => !winner.some((w) => w.name === p.name)),
+  ];
 
   const packByPath = new Map<string, ResolvedPack>();
   /**
@@ -566,19 +535,12 @@ export async function loadAllCustomHooks(
     // being intersected away.
     const winner = existing.effect !== "enforce" && pack.effect === "enforce" ? pack : existing;
     const other = winner === existing ? pack : existing;
-    const catalog = unionCatalog(winner.policies, other.policies);
     packByPath.set(key, {
       ...winner,
-      policies: catalog.policies,
+      policies: unionCatalog(winner.policies, other.policies),
       enabled: unionSelection(winner.enabled, other.enabled),
       clis: unionSelection(winner.clis, other.clis),
     });
-    if (catalog.overruled.length > 0) {
-      warnAuthority(
-        `packs ${existing.id} and ${pack.id} share one artifact and do not all declare ` +
-          `${catalog.overruled.join(", ")} reviewable, so ${catalog.overruled.length === 1 ? "it stays" : "they stay"} hard`,
-      );
-    }
   }
 
   // 1. Explicit custom policy paths. Accept a string for callers/configs using

package/src/hooks/custom-hooks-registry.ts

@@ -4,14 +4,9 @@
  * from 'failproofai') and the hook handler (which reads from this file) share the
  * same in-process state when running within the same Node.js process.
  */
-import type { CustomHook, SemanticPolicyDeclaration } from "./policy-types";
+import type { CustomHook } from "./policy-types";
 
 const REGISTRY_KEY = "__failproofai_custom_hooks__";
-/**
- * Beside the hook registry, on the same key namespace and cleared by the same
- * call — the two are one registration pass and a build step reads both.
- */
-const SEMANTIC_KEY = "__failproofai_semantic_policies__";
 
 function getRegistry(): CustomHook[] {
   const g = globalThis as Record<string, unknown>;
@@ -19,56 +14,17 @@ function getRegistry(): CustomHook[] {
   return g[REGISTRY_KEY] as CustomHook[];
 }
 
-function getSemanticRegistry(): SemanticPolicyDeclaration[] {
-  const g = globalThis as Record<string, unknown>;
-  if (!Array.isArray(g[SEMANTIC_KEY])) g[SEMANTIC_KEY] = [];
-  return g[SEMANTIC_KEY] as SemanticPolicyDeclaration[];
-}
-
 export const customPolicies = {
   add(hook: CustomHook): void {
     getRegistry().push(hook);
   },
 };
 
-/**
- * Register a semantic (Jev) policy — a question set for the classifier, read by
- * `failproofai publish` and emitted as the pack manifest's `semantic` array.
- *
- * A SEPARATE namespace from `customPolicies`, deliberately, rather than a
- * `customPolicies.addSemantic`. A semantic policy has no `fn` and no `match`,
- * and nothing about it ever executes on a user's machine: what installs is the
- * declaration in the manifest, and the artifact's call here matters only at
- * build time. Putting it behind the object whose entries return
- * `allow()`/`deny()` invites exactly the shape confusion the manifest parser
- * would then have to catch — a function on a semantic entry, a probe list on a
- * regex one — and both mistakes would be silent until somebody read a manifest.
- *
- * Nothing is validated here. `parsePackSemanticPolicy` in `pack-manifest.ts`
- * owns every rule, and it is applied at BUILD time (where the author can still
- * fix it) and again at load time (where the bytes may have come from anywhere).
- * Validating a third time in the setter would be a third copy of the rules.
- */
-export const semanticPolicies = {
-  add(policy: SemanticPolicyDeclaration): void {
-    getSemanticRegistry().push(policy);
-  },
-};
-
 export function getCustomHooks(): CustomHook[] {
   return getRegistry();
 }
 
-export function getSemanticRegistrations(): SemanticPolicyDeclaration[] {
-  return getSemanticRegistry();
-}
-
 export function clearCustomHooks(): void {
   const g = globalThis as Record<string, unknown>;
   g[REGISTRY_KEY] = [];
-  // Both maps, on one call. A loader that cleared only the hooks would carry
-  // one entry file's semantic policies into the next file's build — and since
-  // the semantic half is read after the load rather than during it, the extras
-  // would be published under the wrong pack with nothing to notice.
-  g[SEMANTIC_KEY] = [];
 }

package/src/hooks/first-run-gate.ts

@@ -35,11 +35,6 @@ export const FIRST_RUN_EXEMPT_SUBCOMMANDS: readonly string[] = [
   // Same reason: a backfill is an explicit instruction about an already-set-up
   // machine, and interrupting it to offer setup answers a question nobody asked.
   "backfill",
-  // `jev setup` is configuration in its own right, and `jev status` / `test` /
-  // `remove` inspect or undo it. It is also the command most likely to be
-  // scripted with a key on stdin — a wizard in front of it would read that key
-  // as the answer to its first question.
-  "jev",
 ];
 
 export function shouldOfferFirstRun(args: readonly string[]): boolean {