failproofai 1.0.7-beta.2 → 1.0.7

package/src/hooks/policy-catalog.ts

@@ -25,42 +25,12 @@
  * - **Absent optionals stay absent.** `beta`, `alwaysOn` and `params` are read
  *   with `in` and `undefined` checks; default-filling them changes behaviour and
  *   fails existing tests.
- * - **Every entry states its `authority`,** even though absent already means
- *   `hard`: whether Jev may clear a builtin's verdict is a decision to make per
- *   policy, not a default to inherit. `reviewable` only where a semantic policy
- *   genuinely covers the same concern, named in `reviewedBy`. The table and the
- *   reasoning are in `docs/policies/authority.mdx`; `alwaysOn` is hard whatever
- *   it says here.
  *
  * `params.default` values are handed to policies BY REFERENCE, so this must stay
  * one module-level const — never a factory minting fresh defaults per call.
  */
 import type { PolicyCatalogEntry, PolicyParamsSchema } from "./policy-types";
 
-/**
- * ── On `authority` and `reviewedBy` in this file ──
- *
- * `reviewable` means Jev may CLEAR this policy's verdict, and only through the
- * semantic checks named here — every one of which must have been asked.
- *
- * Both ways of getting a pairing wrong are silent, and the asymmetry between
- * them is what decides these rows:
- *
- *   - a check that is never ASKED never clears, so the block becomes permanent
- *   - a check that is asked and does not FIRE answers "no concern", and no
- *     concern CLEARS — so naming a check that does not model this policy's
- *     shapes does not review the policy, it switches it off for exactly the
- *     inputs that check does not understand
- *
- * And an `instruct`-mode check can never answer deny. So the test is not "can
- * the named reviewer keep this block" but "is there anything left that can
- * deny": a deny-mode name in the conjunction, or a deny-mode check covering the
- * same concern independently, or a policy that never denied in the first place.
- * `block-work-on-main` fails all three and is hard for that reason.
- *
- * Each row's own comment says which of those applies. The reasoning was worked
- * out policy by policy in FailproofAI/jev-policies' DECISIONS.md.
- */
 export const POLICY_CATALOG: PolicyCatalogEntry[] = [
   {
     name: "sanitize-jwt",
@@ -68,7 +38,6 @@ export const POLICY_CATALOG: PolicyCatalogEntry[] = [
     displayTitle: "Redacted JWT tokens from tool output",
     impact: "Stops the agent from echoing auth tokens it saw in command output.",
     match: { events: ["PostToolUse"] },
-    authority: "hard",
     defaultEnabled: true,
     category: "Sanitize",
   },
@@ -78,7 +47,6 @@ export const POLICY_CATALOG: PolicyCatalogEntry[] = [
     displayTitle: "Redacted API keys from tool output",
     impact: "Catches OpenAI / Anthropic / GitHub / AWS / Stripe / Google keys before the model sees them.",
     match: { events: ["PostToolUse"] },
-    authority: "hard",
     defaultEnabled: true,
     category: "Sanitize",
     params: {
@@ -95,7 +63,6 @@ export const POLICY_CATALOG: PolicyCatalogEntry[] = [
     displayTitle: "Redacted database connection strings from tool output",
     impact: "Strips embedded DB credentials before they reach the model context.",
     match: { events: ["PostToolUse"] },
-    authority: "hard",
     defaultEnabled: true,
     category: "Sanitize",
   },
@@ -105,7 +72,6 @@ export const POLICY_CATALOG: PolicyCatalogEntry[] = [
     displayTitle: "Redacted PEM private keys from tool output",
     impact: "Prevents private key bodies from being echoed into chat context.",
     match: { events: ["PostToolUse"] },
-    authority: "hard",
     defaultEnabled: true,
     category: "Sanitize",
   },
@@ -115,7 +81,6 @@ export const POLICY_CATALOG: PolicyCatalogEntry[] = [
     impact: "Strips Authorization: Bearer values before they hit the model.",
     description: "Stop Claude from reading Authorization Bearer tokens in tool responses",
     match: { events: ["PostToolUse"] },
-    authority: "hard",
     defaultEnabled: true,
     category: "Sanitize",
   },
@@ -125,8 +90,6 @@ export const POLICY_CATALOG: PolicyCatalogEntry[] = [
     impact: "Env vars often contain secrets; blocking `env` / `printenv` keeps them out of the model context.",
     description: "Prevent commands that read environment variables",
     match: { events: ["PreToolUse"], toolNames: ["Bash"] },
-    authority: "reviewable",
-    reviewedBy: ["env-secrets-dump", "secret-exposure"],
     defaultEnabled: true,
     category: "Environment",
   },
@@ -136,8 +99,6 @@ export const POLICY_CATALOG: PolicyCatalogEntry[] = [
     impact: "`.env` files routinely contain API keys and DB credentials.",
     description: "Block reading/writing .env files",
     match: { events: ["PreToolUse"] },
-    authority: "reviewable",
-    reviewedBy: ["secret-exposure"],
     defaultEnabled: true,
     category: "Environment",
   },
@@ -147,8 +108,6 @@ export const POLICY_CATALOG: PolicyCatalogEntry[] = [
     impact: "Stops the agent from peeking at neighboring repos or your home directory.",
     description: "Block file reads outside the session working directory",
     match: { events: ["PreToolUse"], toolNames: ["Read", "Glob", "Grep", "Bash"] },
-    authority: "reviewable",
-    reviewedBy: ["read-outside-workspace"],
     defaultEnabled: false,
     category: "Environment",
     params: {
@@ -167,18 +126,6 @@ export const POLICY_CATALOG: PolicyCatalogEntry[] = [
     // PermissionRequest is Codex's escalation-approval event; fire the same
     // sudo guard there so Codex sandbox bypasses are blocked too.
     match: { events: ["PreToolUse", "PermissionRequest"], toolNames: ["Bash"] },
-    // Hard, although `privilege-escalation` is deny-mode and its probe is a strict superset
-    // of this matcher — so the pairing would pass the "is there anything left that can
-    // deny" test. The reason it stays hard is the OTHER clearing path: that check is
-    // `userCanOverride: true`, so a human naming the operation clears it, and this policy
-    // is `defaultEnabled: true`. Reviewable would therefore turn "sudo is blocked" into
-    // "sudo is blocked unless you asked for it" on every machine with Jev configured.
-    // Measured against what that buys: the false-block reduction on the labelled corpus
-    // came from `block-read-outside-cwd`, `protect-env-vars` and `block-env-files`, which
-    // were already reviewable. Sudo contributed nothing to it, so the trade is a headline
-    // guarantee for no measured gain. The nine opt-in policies that ARE reviewable here
-    // reach only people who switched them on deliberately.
-    authority: "hard",
     defaultEnabled: true,
     category: "Dangerous Commands",
     params: {
@@ -195,13 +142,6 @@ export const POLICY_CATALOG: PolicyCatalogEntry[] = [
     impact: "`curl ... | sh` runs unverified remote code on your machine.",
     description: "Block piping downloads to shell",
     match: { events: ["PreToolUse"], toolNames: ["Bash"] },
-    // Hard, for the same reason as `block-sudo` above: the `remote-code-execution` pairing is
-    // sound, but the check is overridable by an explicit request and this policy is on by
-    // default, so reviewable would mean "piping a download to a shell is blocked unless you
-    // asked for it". The substring false positive it has — `grep -rn "curl x | sh"` is
-    // denied — is real and is the argument for pairing it; it is also rare enough not to
-    // pay for weakening the default.
-    authority: "hard",
     defaultEnabled: true,
     category: "Dangerous Commands",
   },
@@ -211,13 +151,6 @@ export const POLICY_CATALOG: PolicyCatalogEntry[] = [
     impact: "Catches catastrophic `rm -rf /` and Windows equivalents.",
     description: "Prevent catastrophic deletions",
     match: { events: ["PreToolUse"], toolNames: ["Bash"] },
-    // Reviewable: `destructive-deletion` is deny-mode, and its second probe is this
-    // policy's path-depth heuristic done properly — `irreplaceable`'s false criteria
-    // (build output, dist/, caches, node_modules, virtualenvs, coverage, temp files) is
-    // exactly this heuristic's error term. `rm -rf /` keeps both probes true and stays
-    // denied; `rm -rf node_modules` is the false block this pairing exists to remove.
-    authority: "reviewable",
-    reviewedBy: ["destructive-deletion"],
     defaultEnabled: false,
     category: "Dangerous Commands",
     params: {
@@ -247,7 +180,6 @@ export const POLICY_CATALOG: PolicyCatalogEntry[] = [
     },
     defaultEnabled: true,
     alwaysOn: true,
-    authority: "hard",
     category: "Dangerous Commands",
   },
   {
@@ -256,12 +188,6 @@ export const POLICY_CATALOG: PolicyCatalogEntry[] = [
     impact: "kubectl can change live cluster state — gated unless allow-listed.",
     description: "Block kubectl commands (Kubernetes cluster mutations)",
     match: { events: ["PreToolUse"], toolNames: ["Bash"] },
-    // Reviewable: `production-infra-change` is deny-mode and names kubectl explicitly. This
-    // policy denies the whole CLI, read-only subcommands included; the probe's false
-    // criteria is the split a regex cannot make — get, list, describe, logs, status,
-    // plan, diff, validate, whoami, --dry-run.
-    authority: "reviewable",
-    reviewedBy: ["production-infra-change"],
     defaultEnabled: false,
     category: "Infra Commands",
     params: {
@@ -278,10 +204,6 @@ export const POLICY_CATALOG: PolicyCatalogEntry[] = [
     impact: "Terraform mutates real infrastructure — gated unless allow-listed.",
     description: "Block terraform and tofu (OpenTofu) commands",
     match: { events: ["PreToolUse"], toolNames: ["Bash"] },
-    // Reviewable: same pairing as `block-kubectl`; the probe names terraform and tofu, and
-    // clears `terraform plan` and `terraform validate`.
-    authority: "reviewable",
-    reviewedBy: ["production-infra-change"],
     defaultEnabled: false,
     category: "Infra Commands",
     params: {
@@ -298,10 +220,6 @@ export const POLICY_CATALOG: PolicyCatalogEntry[] = [
     impact: "AWS CLI can spend money or break prod — gated.",
     description: "Block aws CLI commands",
     match: { events: ["PreToolUse"], toolNames: ["Bash"] },
-    // Reviewable: same pairing; the probe names aws, and clears `aws sts
-    // get-caller-identity` and `aws s3 ls`.
-    authority: "reviewable",
-    reviewedBy: ["production-infra-change"],
     defaultEnabled: false,
     category: "Infra Commands",
     params: {
@@ -318,10 +236,6 @@ export const POLICY_CATALOG: PolicyCatalogEntry[] = [
     impact: "gcloud can spend money or break prod — gated.",
     description: "Block gcloud (Google Cloud) CLI commands",
     match: { events: ["PreToolUse"], toolNames: ["Bash"] },
-    // Reviewable: same pairing; the probe names gcloud, and clears `gcloud auth list` and
-    // `gcloud config list`.
-    authority: "reviewable",
-    reviewedBy: ["production-infra-change"],
     defaultEnabled: false,
     category: "Infra Commands",
     params: {
@@ -338,9 +252,6 @@ export const POLICY_CATALOG: PolicyCatalogEntry[] = [
     impact: "az can spend money or break prod — gated.",
     description: "Block az (Azure) CLI commands",
     match: { events: ["PreToolUse"], toolNames: ["Bash"] },
-    // Reviewable: same pairing; the probe names az, and clears `az account show`.
-    authority: "reviewable",
-    reviewedBy: ["production-infra-change"],
     defaultEnabled: false,
     category: "Infra Commands",
     params: {
@@ -357,10 +268,6 @@ export const POLICY_CATALOG: PolicyCatalogEntry[] = [
     impact: "Helm releases mutate cluster state — gated.",
     description: "Block helm commands",
     match: { events: ["PreToolUse"], toolNames: ["Bash"] },
-    // Reviewable: same pairing; the probe names helm, and clears `helm list` and
-    // `helm status`.
-    authority: "reviewable",
-    reviewedBy: ["production-infra-change"],
     defaultEnabled: false,
     category: "Infra Commands",
     params: {
@@ -377,7 +284,6 @@ export const POLICY_CATALOG: PolicyCatalogEntry[] = [
     impact: "Catches `gh workflow run`, `gh pr merge`, `gh secret set`, etc.",
     description: "Block gh CLI pipeline-trigger subcommands (workflow run, run rerun/cancel, pr merge, release create/delete, cache delete, secret set/delete)",
     match: { events: ["PreToolUse"], toolNames: ["Bash"] },
-    authority: "hard",
     defaultEnabled: false,
     category: "Infra Commands",
     params: {
@@ -394,13 +300,6 @@ export const POLICY_CATALOG: PolicyCatalogEntry[] = [
     impact: "Stops the agent from creating `.pem`, `id_rsa`, `credentials.json`, etc.",
     description: "Block writing secret key files",
     match: { events: ["PreToolUse"], toolNames: ["Write"] },
-    // Reviewable: `secret-exposure` is deny-mode and `write` is in its `appliesTo`, so a
-    // real private key still comes back deny. What clears is this matcher's substring
-    // problem — `/credentials/` and `id_rsa` unanchored against a whole path, which
-    // catches `src/auth/credentials.ts`. `credential-exfiltration` would have been a
-    // dead name here: it applies to shell and network, and a file write is neither.
-    authority: "reviewable",
-    reviewedBy: ["secret-exposure"],
     defaultEnabled: false,
     category: "Dangerous Commands",
     params: {
@@ -417,7 +316,6 @@ export const POLICY_CATALOG: PolicyCatalogEntry[] = [
     impact: "Direct pushes to a protected branch bypass review.",
     description: "Block pushing to main/master",
     match: { events: ["PreToolUse"], toolNames: ["Bash"] },
-    authority: "hard",
     defaultEnabled: true,
     category: "Git",
     params: {
@@ -434,13 +332,6 @@ export const POLICY_CATALOG: PolicyCatalogEntry[] = [
     impact: "Force-pushes rewrite history and can clobber teammates' work.",
     description: "Prevent force-pushing to any branch",
     match: { events: ["PreToolUse"], toolNames: ["Bash"] },
-    // Reviewable: `git-history-rewrite` is deny-mode and its probe is a superset of this
-    // matcher — it counts `--force-with-lease` (which `isForcePushFlag` deliberately
-    // treats as safe), a `+refspec`, and a remote-branch delete, and says `git -C dir`
-    // and an absolute binary path change nothing. A real force-push stays blocked; what
-    // clears is the user asking to force-push their own branch.
-    authority: "reviewable",
-    reviewedBy: ["git-history-rewrite"],
     defaultEnabled: false,
     category: "Git",
   },
@@ -450,21 +341,6 @@ export const POLICY_CATALOG: PolicyCatalogEntry[] = [
     impact: "Work should land via PR — direct commits skip review.",
     description: "Block git commits and merges on main/master branch",
     match: { events: ["PreToolUse"], toolNames: ["Bash"] },
-    // Hard, although `commit-on-protected-branch` covers exactly this concern.
-    // That check is `mode: "instruct"`, and an instruct-mode reviewer can never
-    // answer deny — so the conjunction had one reachable outcome, cleared, and
-    // marking this reviewable did not hand the decision to Jev. It switched the
-    // policy off on every machine that configured Jev, while the mark said
-    // otherwise.
-    //
-    // The test that matters is not "can the reviewer keep this block" but "is
-    // there anything left that can deny". `block-read-outside-cwd` also has only
-    // an instruct reviewer and stays reviewable, because when it clears,
-    // `secret-exposure` and `credential-exfiltration` are still asked about the
-    // same read and still deny on their own through the most-severe merge. Here
-    // nothing else covers committing on a protected branch, so a clear leaves
-    // the concern unenforced by anything.
-    authority: "hard",
     defaultEnabled: false,
     category: "Git",
     params: {
@@ -481,8 +357,6 @@ export const POLICY_CATALOG: PolicyCatalogEntry[] = [
     impact: "Amending after a push rewrites history that others may have pulled.",
     description: "Warns before amending git commits, which rewrites history",
     match: { events: ["PreToolUse"], toolNames: ["Bash"] },
-    authority: "reviewable",
-    reviewedBy: ["git-history-rewrite"],
     defaultEnabled: false,
     category: "Git",
   },
@@ -492,70 +366,8 @@ export const POLICY_CATALOG: PolicyCatalogEntry[] = [
     impact: "Stash deletions are permanent and silent.",
     description: "Warns before permanently deleting stashed changes",
     match: { events: ["PreToolUse"], toolNames: ["Bash"] },
-    authority: "hard",
-    defaultEnabled: false,
-    category: "Git",
-  },
-  {
-    name: "warn-git-clean",
-    displayTitle: "Tried to delete untracked or ignored files with git clean",
-    impact: "`git clean -fdx` takes `.env`, local config and unstaged work — git never had a copy of any of it.",
-    description: "Warns before git clean deletes untracked directories (-d) or ignored files (-x / -X)",
-    match: { events: ["PreToolUse"], toolNames: ["Bash"] },
-    // Hard, and deliberately NOT `reviewable` through `destructive-deletion`,
-    // although that check is the one whose whole subject is deleting data that
-    // cannot be regenerated.
-    //
-    // Measured on a real machine, through the real hook, with a Jev config
-    // present, on `git clean -fdx`:
-    //
-    //     jev:    ok decision=allow applied=two-tier 495ms
-    //     probes: destructive-deletion.destroys=0.94  beyond_task=0.79  task_step=0.78
-    //
-    // `destroys` came back 0.94 — the check sees the destruction; its own
-    // instructions name `git clean -fdx` by example. The policy still did not
-    // fire, because evidence is the MIN over a policy's probes and the partner
-    // probe `irreplaceable` came back low (it is absent from the probe line,
-    // which lists only what answered above the display floor). That is not a
-    // tuning accident: `git clean` carries NO path operand, so `facts.paths` is
-    // empty (measured — `extractPaths` skips `clean` as not path-like and
-    // `-fdx` as a flag), while `irreplaceable` is written to read
-    // `facts.paths[].relation` and to answer false for "only regenerable data
-    // inside the project: build output, dist/, caches, node_modules, …". With
-    // nothing to point at, the false branch is the honest answer to the
-    // question as written.
-    //
-    // A named check that is asked and does not fire answers "no concern", and
-    // that CLEARS (`combine.ts`, "A warning-level answer clears the deny"). So
-    // pairing this policy with `destructive-deletion` would not hand the
-    // decision to Jev — it would switch the policy off on every machine that
-    // configured Jev, which is exactly the `block-work-on-main` mistake. The
-    // test is "is there anything left that can DENY", and no other deny-mode
-    // semantic check covers untracked-file deletion, so a clear would leave the
-    // concern enforced by nothing. Hard until the probe is recalibrated against
-    // the corpus; the proposed wording and why it needs a replay are in
-    // `PROBE-FOLLOWUP.md`.
-    authority: "hard",
-    // Off by default, and `instruct` rather than `deny`, because `git clean
-    // -fdx` is a command developers run on purpose and often — it is the
-    // standard way to get a genuinely clean tree before a build. A default-on
-    // deny would fire on ordinary work, and a guard people switch off protects
-    // nothing; every policy in this category except `block-push-master` is
-    // default-off for the same reason, and `block-read-outside-cwd` was
-    // demoted out of the audit's archetype signal for being exactly this kind
-    // of ambient. What IS worth saying every time it is enabled is that the
-    // blast radius is wider than the operator usually means, so the policy
-    // warns and names what goes.
     defaultEnabled: false,
     category: "Git",
-    params: {
-      destructiveFlags: {
-        type: "string[]",
-        description:
-          "git clean flag letters that make it worth warning about, checked alongside --force. Narrow to ['x','X'] to allow `git clean -fd`, or widen with 'f' to warn on a bare `git clean -f`.",
-        default: ["d", "x", "X"],
-      },
-    } satisfies PolicyParamsSchema,
   },
   {
     name: "warn-all-files-staged",
@@ -563,7 +375,6 @@ export const POLICY_CATALOG: PolicyCatalogEntry[] = [
     impact: "Wide stages routinely catch generated files or secrets you didn't intend to commit.",
     description: "Warns before staging all working tree files with git add -A / . / --all",
     match: { events: ["PreToolUse"], toolNames: ["Bash"] },
-    authority: "hard",
     defaultEnabled: false,
     category: "Git",
   },
@@ -573,8 +384,6 @@ export const POLICY_CATALOG: PolicyCatalogEntry[] = [
     impact: "Easy way to wipe a table by accident.",
     description: "Warn before executing destructive SQL (DROP/TRUNCATE/DELETE without WHERE) via database clients",
     match: { events: ["PreToolUse"], toolNames: ["Bash"] },
-    authority: "reviewable",
-    reviewedBy: ["database-destruction"],
     defaultEnabled: false,
     category: "Database",
   },
@@ -584,7 +393,6 @@ export const POLICY_CATALOG: PolicyCatalogEntry[] = [
     impact: "ALTER TABLE operations can lock tables and break readers.",
     description: "Warns before SQL schema changes (ALTER TABLE with column or rename operations)",
     match: { events: ["PreToolUse"], toolNames: ["Bash"] },
-    authority: "hard",
     defaultEnabled: false,
     category: "Database",
   },
@@ -594,7 +402,6 @@ export const POLICY_CATALOG: PolicyCatalogEntry[] = [
     impact: "Publishes are irreversible — `npm publish` / `cargo publish` shouldn't happen without intent.",
     description: "Warn before publishing packages to public registries (npm, PyPI, crates.io, RubyGems, etc.)",
     match: { events: ["PreToolUse"], toolNames: ["Bash"] },
-    authority: "hard",
     defaultEnabled: false,
     category: "Packages & System",
   },
@@ -604,8 +411,6 @@ export const POLICY_CATALOG: PolicyCatalogEntry[] = [
     impact: "`npm i -g`, `cargo install`, `pip --user` pollute your machine outside the project.",
     description: "Warns before installing packages globally (npm -g, cargo install, etc.)",
     match: { events: ["PreToolUse"], toolNames: ["Bash"] },
-    authority: "reviewable",
-    reviewedBy: ["system-modification"],
     defaultEnabled: false,
     category: "Packages & System",
   },
@@ -615,7 +420,6 @@ export const POLICY_CATALOG: PolicyCatalogEntry[] = [
     impact: "Mixing package managers creates lockfile churn for your team.",
     description: "Blocks non-preferred package managers and tells Claude to use an allowed one (e.g., uv instead of pip)",
     match: { events: ["PreToolUse"], toolNames: ["Bash"] },
-    authority: "hard",
     defaultEnabled: false,
     category: "Packages & System",
     params: {
@@ -637,7 +441,6 @@ export const POLICY_CATALOG: PolicyCatalogEntry[] = [
     impact: "Catches accidentally large file writes (logs, binaries, model dumps).",
     description: "Warn before writing files larger than 1MB (configurable via thresholdKb param)",
     match: { events: ["PreToolUse"], toolNames: ["Write"] },
-    authority: "hard",
     defaultEnabled: false,
     category: "Packages & System",
     params: {
@@ -654,7 +457,6 @@ export const POLICY_CATALOG: PolicyCatalogEntry[] = [
     impact: "Catches `nohup` / `&` / `screen` / `tmux` / `disown` patterns that the agent often forgets to clean up.",
     description: "Warns before starting detached or background processes",
     match: { events: ["PreToolUse"], toolNames: ["Bash"] },
-    authority: "hard",
     defaultEnabled: false,
     category: "Packages & System",
   },
@@ -664,7 +466,6 @@ export const POLICY_CATALOG: PolicyCatalogEntry[] = [
     impact: "Usually a sign of a stuck loop burning tokens.",
     description: "Warn when the same tool is called 3+ times with identical parameters",
     match: { events: ["PreToolUse"] },
-    authority: "hard",
     defaultEnabled: false,
     category: "AI Behavior",
   },
@@ -674,7 +475,6 @@ export const POLICY_CATALOG: PolicyCatalogEntry[] = [
     impact: "Work not in a commit is invisible to teammates and easy to lose.",
     description: "Require all changes to be committed before Claude stops",
     match: { events: ["Stop"] },
-    authority: "hard",
     defaultEnabled: false,
     category: "Workflow",
   },
@@ -684,7 +484,6 @@ export const POLICY_CATALOG: PolicyCatalogEntry[] = [
     impact: "Local-only commits won't trigger CI or be reviewable.",
     description: "Require all commits to be pushed to remote before Claude stops",
     match: { events: ["Stop"] },
-    authority: "hard",
     defaultEnabled: false,
     category: "Workflow",
     params: {
@@ -706,7 +505,6 @@ export const POLICY_CATALOG: PolicyCatalogEntry[] = [
     impact: "Branches without PRs don't get reviewed.",
     description: "Require a pull request to exist for the current branch before Claude stops",
     match: { events: ["Stop"] },
-    authority: "hard",
     defaultEnabled: false,
     category: "Workflow",
     params: {
@@ -723,7 +521,6 @@ export const POLICY_CATALOG: PolicyCatalogEntry[] = [
     impact: "Conflicting branches can't merge — surface them early.",
     description: "Require the current branch to merge cleanly with the base branch before Claude stops",
     match: { events: ["Stop"] },
-    authority: "hard",
     defaultEnabled: false,
     category: "Workflow",
     params: {
@@ -740,7 +537,6 @@ export const POLICY_CATALOG: PolicyCatalogEntry[] = [
     impact: "Failing CI blocks deploy.",
     description: "Require CI checks to pass on the current HEAD commit before Claude stops (ignores stale runs on prior commits)",
     match: { events: ["Stop"] },
-    authority: "hard",
     defaultEnabled: false,
     category: "Workflow",
   },