finitemonkey 0.1.0-next.15 → 0.1.0-next.17

package/dist/finitemonkey.mjs

@@ -40,8 +40,8 @@ var parseJsonObject = (text6) => {
   if (!parsed.ok) return parsed;
   return isRecord(parsed.value) ? accept(parsed.value) : reject("expected a JSON object");
 };
-var optionalString = (record2, key) => {
-  const value = record2[key];
+var optionalString = (record3, key) => {
+  const value = record3[key];
   return typeof value === "string" ? value : void 0;
 };
 
@@ -69,7 +69,7 @@ var resolveWindowsCommand = (command, env, exists) => {
   }
   return { command, shell: false };
 };
-var windowsCommandLine = (resolved, args) => [quoteForCmd(resolved.command), ...args.map(quoteForCmd)].join(" ");
+var windowsCommandLine = (resolved, args2) => [quoteForCmd(resolved.command), ...args2.map(quoteForCmd)].join(" ");
 
 // src/core/node-exec.ts
 var SHELL_NOT_FOUND = /* @__PURE__ */ new Set([127, 9009]);
@@ -117,9 +117,9 @@ var nodeAppendText = (path, content) => {
     return reject(error instanceof Error ? error.message : String(error));
   }
 };
-var nodeSpawnSelf = (selfPath) => (args, cwd) => {
+var nodeSpawnSelf = (selfPath) => (args2, cwd) => {
   try {
-    const child2 = spawn(process.execPath, [selfPath, ...args], {
+    const child2 = spawn(process.execPath, [selfPath, ...args2], {
       cwd,
       detached: true,
       stdio: "ignore",
@@ -290,8 +290,8 @@ import { createInterface } from "node:readline";
 var MAX_BUFFER2 = 256 * 1024 * 1024;
 var GIT_ENV = { ...process.env, GIT_PAGER: "cat", GIT_TERMINAL_PROMPT: "0", LC_ALL: "C" };
 var notFound = (error) => error instanceof Error && "code" in error && error.code === "ENOENT";
-var nodeGit = (args, cwd) => {
-  const result = spawnSync2("git", [...args], {
+var nodeGit = (args2, cwd) => {
+  const result = spawnSync2("git", [...args2], {
     cwd,
     encoding: "utf8",
     maxBuffer: MAX_BUFFER2,
@@ -305,8 +305,8 @@ var nodeGit = (args, cwd) => {
     stdout: typeof stdout === "string" ? stdout : ""
   };
 };
-var nodeGitLines = (args, cwd, onLine) => new Promise((resolve2) => {
-  const child2 = spawn2("git", [...args], {
+var nodeGitLines = (args2, cwd, onLine) => new Promise((resolve2) => {
+  const child2 = spawn2("git", [...args2], {
     cwd,
     windowsHide: true,
     env: GIT_ENV,
@@ -323,8 +323,8 @@ var nodeGitLines = (args, cwd, onLine) => new Promise((resolve2) => {
   });
 });
 var textOf = (value) => typeof value === "string" ? value : "";
-var nodeGitWith = (args, cwd, options) => {
-  const result = spawnSync2("git", [...args], {
+var nodeGitWith = (args2, cwd, options) => {
+  const result = spawnSync2("git", [...args2], {
     cwd,
     encoding: "utf8",
     maxBuffer: MAX_BUFFER2,
@@ -350,15 +350,15 @@ var errnoCode2 = (error) => {
   if (!(error instanceof Error) || !("code" in error)) return void 0;
   return typeof error.code === "string" ? error.code : void 0;
 };
-var spawnProbe = (command, args, timeout) => {
+var spawnProbe = (command, args2, timeout) => {
   const options = { encoding: "utf8", timeout, windowsHide: true };
-  return process.platform === "win32" ? spawnSync3([command, ...args].join(" "), { ...options, shell: true }) : spawnSync3(command, [...args], options);
+  return process.platform === "win32" ? spawnSync3([command, ...args2].join(" "), { ...options, shell: true }) : spawnSync3(command, [...args2], options);
 };
-var nodeProbe = (command, args, timeoutMs) => {
-  if (![command, ...args].every((token) => SAFE_TOKEN.test(token))) {
+var nodeProbe = (command, args2, timeoutMs) => {
+  if (![command, ...args2].every((token) => SAFE_TOKEN.test(token))) {
     return { found: false, ok: false, stdout: "", timedOut: false };
   }
-  const result = spawnProbe(command, args, timeoutMs);
+  const result = spawnProbe(command, args2, timeoutMs);
   const code = errnoCode2(result.error);
   const stdout = result.stdout;
   return {
@@ -409,14 +409,155 @@ var nodeRuntime = () => ({
   exec: nodeExec,
   appendText: nodeAppendText,
   spawnSelf: nodeSpawnSelf(SELF_PATH),
+  execSelf: (args2, cwd, timeoutMs) => nodeExec({ command: process.execPath, args: [SELF_PATH, ...args2], cwd, timeoutMs }),
   gitWith: nodeGitWith,
   realpath: nodeRealpath,
   homeDir: homedir,
   systemLocale: () => Intl.DateTimeFormat().resolvedOptions().locale
 });
 
-// src/commands/doctor.ts
-import { dirname as dirname7 } from "node:path";
+// src/app/node-process.ts
+import { spawn as spawn3, spawnSync as spawnSync4 } from "node:child_process";
+import { connect } from "node:net";
+var MAX_OUTPUT = 64 * 1024;
+var POLL_MS = 150;
+var STOP_GRACE_MS = 3e3;
+var sleep = (ms) => new Promise((resolve2) => {
+  setTimeout(resolve2, ms);
+});
+var portOpen = (host, port) => new Promise((resolve2) => {
+  const socket = connect({ host, port });
+  const done = (open) => {
+    socket.destroy();
+    resolve2(open);
+  };
+  socket.setTimeout(1e3, () => {
+    done(false);
+  });
+  socket.once("connect", () => {
+    done(true);
+  });
+  socket.once("error", () => {
+    done(false);
+  });
+});
+var startApp = (command, cwd, port) => {
+  const child2 = spawn3(command, {
+    cwd,
+    shell: true,
+    detached: process.platform !== "win32",
+    windowsHide: true,
+    stdio: ["ignore", "pipe", "pipe"],
+    env: { ...process.env, PORT: String(port) }
+  });
+  let output = "";
+  let exit;
+  const collect4 = (chunk) => {
+    output = `${output}${chunk.toString("utf8")}`.slice(-MAX_OUTPUT);
+  };
+  child2.stdout.on("data", collect4);
+  child2.stderr.on("data", collect4);
+  child2.once("error", (error) => {
+    output = `${output}${error.message}`;
+    exit = { code: null };
+  });
+  child2.once("exit", (code) => {
+    exit = { code };
+  });
+  return { child: child2, output: () => output, exited: () => exit };
+};
+var waitForPort = async (app, host, port, deadline) => {
+  while (Date.now() < deadline) {
+    if (await portOpen(host, port)) return "open";
+    if (app.exited() !== void 0) return "exited";
+    await sleep(POLL_MS);
+  }
+  return "timeout";
+};
+var signalGroup = (pid, signal) => {
+  try {
+    process.kill(-pid, signal);
+  } catch {
+    return;
+  }
+};
+var alive = (pid) => {
+  try {
+    process.kill(-pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+};
+var stopApp = async (app) => {
+  const pid = app.child.pid;
+  if (pid === void 0) return true;
+  if (process.platform === "win32") {
+    spawnSync4("taskkill", ["/pid", String(pid), "/T", "/F"], { windowsHide: true, stdio: "ignore" });
+    return true;
+  }
+  signalGroup(pid, "SIGTERM");
+  const deadline = Date.now() + STOP_GRACE_MS;
+  while (alive(pid) && Date.now() < deadline) await sleep(POLL_MS);
+  if (alive(pid)) signalGroup(pid, "SIGKILL");
+  return !alive(pid);
+};
+
+// src/app/node-probe.ts
+var BODY_EXCERPT = 200;
+var MAX_BODY = 256 * 1024;
+var url = (request) => {
+  const host = request.host.includes(":") ? `[${request.host}]` : request.host;
+  return `http://${host}:${String(request.port)}${request.route.startsWith("/") ? "" : "/"}${request.route}`;
+};
+var ask = async (request, deadline) => {
+  try {
+    const response = await fetch(url(request), {
+      redirect: "manual",
+      signal: AbortSignal.timeout(Math.max(1e3, deadline - Date.now()))
+    });
+    const body2 = (await response.text()).slice(0, MAX_BODY);
+    const excerpt = body2.slice(0, BODY_EXCERPT);
+    if (response.status !== request.status)
+      return { kind: "wrong_status", status: response.status, bodyExcerpt: excerpt };
+    if (request.body !== void 0 && !body2.includes(request.body)) {
+      return { kind: "body_mismatch", status: response.status, bodyExcerpt: excerpt };
+    }
+    return { kind: "ok", status: response.status };
+  } catch (error) {
+    return { kind: "request_failed", bodyExcerpt: error instanceof Error ? error.message : String(error) };
+  }
+};
+var finish = async (app, answer, started) => {
+  const stopped = app === void 0 ? true : await stopApp(app);
+  return {
+    ...answer,
+    reused: app === void 0,
+    output: app?.output() ?? "",
+    stopped,
+    durationMs: Date.now() - started
+  };
+};
+var probeApp = async (request) => {
+  const started = Date.now();
+  const deadline = started + request.timeoutMs;
+  if (await portOpen(request.host, request.port)) return finish(void 0, await ask(request, deadline), started);
+  if (request.start === void 0) return finish(void 0, { kind: "no_start" }, started);
+  const app = startApp(request.start, request.cwd, request.port);
+  const port = await waitForPort(app, request.host, request.port, deadline);
+  if (port === "exited") return finish(app, { kind: "crashed", exitCode: app.exited()?.code ?? null }, started);
+  if (port === "timeout") return finish(app, { kind: "no_port" }, started);
+  return finish(app, await ask(request, deadline), started);
+};
+
+// src/app/types.ts
+var DEFAULT_HOST = "127.0.0.1";
+var DEFAULT_ROUTE = "/";
+var DEFAULT_STATUS = 200;
+var DEFAULT_APP_TIMEOUT_S = 60;
+
+// src/core/args.ts
+import { parseArgs } from "node:util";
 
 // src/exit-codes.ts
 var ExitCode = {
@@ -444,6 +585,89 @@ var exitCodeDocs = {
   5: "exit.internal"
 };
 
+// src/core/problem.ts
+var usageProblem = (code, messageKey, fix, params2 = {}) => ({
+  code,
+  messageKey,
+  params: params2,
+  fix,
+  exitCode: ExitCode.Usage
+});
+var needsPersonProblem = (messageKey, fix, params2 = {}) => ({
+  code: "needs_confirmation",
+  messageKey,
+  params: params2,
+  fix,
+  exitCode: ExitCode.NeedsPerson
+});
+var FmError = class extends Error {
+  problem;
+  constructor(problem4) {
+    super(problem4.code);
+    this.name = "FmError";
+    this.problem = problem4;
+  }
+};
+
+// src/core/args.ts
+var GLOBAL_OPTIONS = {
+  json: { type: "boolean" },
+  lang: { type: "string" },
+  yes: { type: "boolean", short: "y" },
+  "dry-run": { type: "boolean" },
+  version: { type: "boolean", short: "v" },
+  help: { type: "boolean", short: "h" }
+};
+var flag = (values, name) => values[name] === true;
+var looseArgs = (argv) => {
+  const { values, positionals } = parseArgs({
+    args: [...argv],
+    options: GLOBAL_OPTIONS,
+    strict: false,
+    allowPositionals: true
+  });
+  const lang = values.lang;
+  return {
+    positionals,
+    json: flag(values, "json"),
+    yes: flag(values, "yes"),
+    dryRun: flag(values, "dry-run"),
+    version: flag(values, "version"),
+    help: flag(values, "help"),
+    lang: typeof lang === "string" ? lang : void 0
+  };
+};
+var resolveCommand = (registry, positionals) => registry.filter((spec2) => spec2.path.every((part2, index) => positionals[index] === part2)).reduce(
+  (best, spec2) => best === void 0 || spec2.path.length > best.consumed ? { spec: spec2, consumed: spec2.path.length } : best,
+  void 0
+);
+var strictArgs = (argv, spec2) => {
+  const fix = `finitemonkey help ${spec2.path.join(" ")}`;
+  let parsed;
+  try {
+    parsed = parseArgs({
+      args: [...argv],
+      options: { ...GLOBAL_OPTIONS, ...spec2.options },
+      strict: true,
+      allowPositionals: true
+    });
+  } catch (error) {
+    const detail = error instanceof Error ? error.message : String(error);
+    return reject(usageProblem("invalid_arguments", "error.invalid_arguments", fix, { detail }));
+  }
+  const rest = parsed.positionals.slice(spec2.path.length);
+  const max = spec2.maxPositionals ?? 0;
+  const extra = rest[max];
+  if (extra !== void 0) {
+    return reject(usageProblem("unexpected_argument", "error.unexpected_argument", fix, { argument: extra }));
+  }
+  return accept({ values: parsed.values, positionals: rest });
+};
+var stringOption = (values, name) => {
+  const value = values[name];
+  return typeof value === "string" ? value : void 0;
+};
+
 // src/core/result.ts
 var SCHEMA_VERSION = 1;
 var success = (data, human2 = []) => ({
@@ -468,6 +692,87 @@ var toEnvelope = (command, result) => ({
   ...result.next === void 0 ? {} : { next: result.next }
 });
 
+// src/commands/app-check.ts
+var APP_CHECK_SCHEMA = "finitemonkey/app-check@1";
+var positive = (raw, fallback) => {
+  if (raw === void 0) return fallback;
+  const value = Number(raw);
+  return Number.isInteger(value) && value > 0 ? value : void 0;
+};
+var requestFrom = (ctx, values) => {
+  const port = positive(stringOption(values, "port"), 0);
+  const status = positive(stringOption(values, "status"), DEFAULT_STATUS);
+  const timeout = positive(stringOption(values, "timeout"), DEFAULT_APP_TIMEOUT_S);
+  if (port === void 0 || port === 0 || port > 65535 || status === void 0 || timeout === void 0)
+    return void 0;
+  return {
+    host: stringOption(values, "host") ?? DEFAULT_HOST,
+    port,
+    route: stringOption(values, "route") ?? DEFAULT_ROUTE,
+    status,
+    body: stringOption(values, "body"),
+    start: stringOption(values, "start"),
+    cwd: ctx.cwd,
+    timeoutMs: timeout * 1e3
+  };
+};
+var humanLine = (ctx, data) => ctx.t(`app.check.${data.kind}`, {
+  url: data.url,
+  status: data.status ?? 0,
+  code: data.exitCode ?? -1
+});
+var toResult = (ctx, request, data) => {
+  const human2 = [humanLine(ctx, data)];
+  if (data.kind === "ok") return success(data, human2);
+  return {
+    ok: false,
+    exitCode: ExitCode.CheckFailed,
+    data,
+    human: human2,
+    error: {
+      code: "app_check_failed",
+      message: human2.join(" "),
+      fix: `finitemonkey app check --port ${String(request.port)}`
+    }
+  };
+};
+var appCheckCommand = {
+  path: ["app", "check"],
+  summaryKey: "command.app_check.summary",
+  usage: "finitemonkey app check --port <n> [--start <command>] [--route <path>] [--status <code>] [--body <text>] [--timeout <seconds>] [--host <host>]",
+  status: "ready",
+  options: {
+    port: { type: "string" },
+    start: { type: "string" },
+    route: { type: "string" },
+    status: { type: "string" },
+    body: { type: "string" },
+    timeout: { type: "string" },
+    host: { type: "string" }
+  },
+  run: async (ctx, args2) => {
+    const request = requestFrom(ctx, args2.values);
+    if (request === void 0) {
+      return {
+        ok: false,
+        exitCode: ExitCode.Usage,
+        human: [ctx.t("app.check.usage")],
+        error: {
+          code: "app_check_failed",
+          message: ctx.t("app.check.usage"),
+          fix: "finitemonkey app check --port 3000"
+        }
+      };
+    }
+    const result = await probeApp(request);
+    const url2 = `http://${request.host}:${String(request.port)}${request.route}`;
+    return toResult(ctx, request, { schema: APP_CHECK_SCHEMA, url: url2, ...result });
+  }
+};
+
+// src/commands/doctor.ts
+import { dirname as dirname7 } from "node:path";
+
 // src/install/apply.ts
 import { dirname as dirname3 } from "node:path";
 
@@ -512,12 +817,12 @@ var parseAdded = (value) => {
   const deny2 = strings(value["deny"]);
   const { schema, attribution } = value;
   if (deny2 === void 0 || typeof schema !== "boolean" || typeof attribution !== "boolean") return void 0;
-  const ask = strings(value["ask"]) ?? [];
+  const ask2 = strings(value["ask"]) ?? [];
   const blockReads = value["blockReads"] === true;
   const marketplace = value["marketplace"] === true;
   const plugin = value["plugin"] === true;
   const language = value["language"];
-  const added = { schema, attribution, deny: deny2, ask, blockReads, marketplace, plugin };
+  const added = { schema, attribution, deny: deny2, ask: ask2, blockReads, marketplace, plugin };
   return typeof language === "string" ? { ...added, language } : added;
 };
 var parseEntry = (value) => {
@@ -544,11 +849,11 @@ var parseEntries = (value) => {
   const entries = value.map(parseEntry);
   return entries.every((entry2) => entry2 !== void 0) ? entries : void 0;
 };
-var fromRecord = (record2) => {
-  const { schema, version, preset, installedAt, updatedAt } = record2;
+var fromRecord = (record3) => {
+  const { schema, version, preset, installedAt, updatedAt } = record3;
   const known2 = PRESETS.find((item) => item === preset);
-  const entries = parseEntries(record2["entries"]);
-  const createdDirs = strings(record2["createdDirs"]);
+  const entries = parseEntries(record3["entries"]);
+  const createdDirs = strings(record3["createdDirs"]);
   if (schema !== LOCK_SCHEMA) return reject(`schema is not ${LOCK_SCHEMA}`);
   if (typeof version !== "string" || typeof installedAt !== "string" || typeof updatedAt !== "string") {
     return reject("version, installedAt and updatedAt must be text");
@@ -565,6 +870,134 @@ var parseLock = (text6) => {
 var renderLock = (lock) => `${JSON.stringify(lock, null, 2)}
 `;
 
+// src/policy/policy.ts
+import { join as join3 } from "node:path";
+
+// src/git/project-config.ts
+import { join as join2 } from "node:path";
+var CONFIG_FILE2 = ".finitemonkey/config.yml";
+var unquote = (value) => value.trim().replace(/^(["'])(.*)\1$/s, "$2");
+var stripComment = (line2) => {
+  let quote;
+  for (let index = 0; index < line2.length; index += 1) {
+    const char = line2.charAt(index);
+    if (quote === void 0 && (char === '"' || char === "'")) quote = char;
+    else if (char === quote) quote = void 0;
+    else if (quote === void 0 && char === "#" && (index === 0 || /\s/.test(line2.charAt(index - 1)))) {
+      return line2.slice(0, index);
+    }
+  }
+  return line2;
+};
+var flowList = (value) => {
+  const trimmed = value.trim();
+  if (!trimmed.startsWith("[") || !trimmed.endsWith("]")) return void 0;
+  return trimmed.slice(1, -1).split(",").map(unquote).filter((item) => item !== "");
+};
+var keyValue = (body2) => {
+  const match = /^("[^"]*"|'[^']*'|[^:]+?)\s*:(?:\s+(.*))?$/.exec(body2);
+  if (match === null) return void 0;
+  return { key: unquote(match[1] ?? ""), value: match[2] ?? "" };
+};
+var addItem = (frame, item) => {
+  if (frame.key === void 0) return;
+  const parent = frame.tree[frame.key];
+  if (Array.isArray(parent)) parent.push(item);
+  else frame.tree[frame.key] = [item];
+};
+var placeLine = (stack, indent, body2) => {
+  while (stack.length > 1 && (stack[stack.length - 1]?.indent ?? 0) >= indent && !body2.startsWith("- ")) stack.pop();
+  const top = stack[stack.length - 1];
+  if (top === void 0) return;
+  if (body2.startsWith("- ")) {
+    addItem(top, unquote(body2.slice(2)));
+    return;
+  }
+  const pair = keyValue(body2);
+  if (pair === void 0) return;
+  const parentTree = top.key === void 0 ? top.tree : ensureTree(top.tree, top.key);
+  if (pair.value === "") {
+    stack.push({ indent, tree: parentTree, key: pair.key });
+    return;
+  }
+  parentTree[pair.key] = flowList(pair.value) ?? unquote(pair.value);
+};
+var ensureTree = (tree, key) => {
+  const existing = tree[key];
+  if (existing !== void 0 && typeof existing !== "string" && !Array.isArray(existing)) return existing;
+  const fresh3 = {};
+  tree[key] = fresh3;
+  return fresh3;
+};
+var parseConfigYaml = (text6) => {
+  const root = {};
+  const stack = [{ indent: -1, tree: root, key: void 0 }];
+  for (const raw of text6.split(/\r?\n/)) {
+    const line2 = stripComment(raw).trimEnd();
+    if (line2.trim() === "" || line2.trim() === "---") continue;
+    const indent = line2.length - line2.trimStart().length;
+    placeLine(stack, indent, line2.trim());
+  }
+  return root;
+};
+var isTree = (node) => typeof node === "object" && !Array.isArray(node);
+var configAt = (tree, ...path) => path.reduce((node, key) => isTree(node) ? node[key] : void 0, tree);
+var configList = (tree, ...path) => {
+  const node = configAt(tree, ...path);
+  if (typeof node === "string") return node === "" ? [] : [node];
+  return Array.isArray(node) ? node.filter((item) => typeof item === "string") : [];
+};
+var configMap = (tree, ...path) => {
+  const node = configAt(tree, ...path);
+  if (!isTree(node)) return {};
+  return Object.fromEntries(
+    Object.entries(node).filter((entry2) => typeof entry2[1] === "string")
+  );
+};
+var loadProjectConfig = (runtime, root) => {
+  const text6 = runtime.readText(toAbsolutePath(join2(root, CONFIG_FILE2)));
+  return text6.ok ? parseConfigYaml(text6.value) : {};
+};
+
+// src/policy/policy.ts
+var POLICY_FILE = ".finitemonkey/policy.yml";
+var GUARD_MODES = ["off", "shadow", "active"];
+var LEVELS = ["light", "standard", "strict"];
+var SEVERITIES = ["low", "medium", "high"];
+var DEFAULT_PROMOTE_AFTER = 20;
+var OPTIONAL_GUARDS = ["prose"];
+var DEFAULT_POLICY = {
+  exists: false,
+  level: "standard",
+  severity: "medium",
+  promoteAfter: DEFAULT_PROMOTE_AFTER,
+  guards: {}
+};
+var pick = (options, value, fallback) => options.find((option) => option === value) ?? fallback;
+var parsePolicy = (text6) => {
+  const tree = parseConfigYaml(text6);
+  const raw = configAt(tree, "promoteAfter");
+  const promoteAfter = typeof raw === "string" ? Number.parseInt(raw, 10) : Number.NaN;
+  const guards = Object.fromEntries(
+    Object.entries(configMap(tree, "guards")).flatMap(([id, mode]) => {
+      const known2 = GUARD_MODES.find((option) => option === mode);
+      return known2 === void 0 ? [] : [[id, known2]];
+    })
+  );
+  return {
+    exists: true,
+    level: pick(LEVELS, configAt(tree, "level"), DEFAULT_POLICY.level),
+    severity: pick(SEVERITIES, configAt(tree, "severity"), DEFAULT_POLICY.severity),
+    promoteAfter: Number.isInteger(promoteAfter) && promoteAfter > 0 ? promoteAfter : DEFAULT_PROMOTE_AFTER,
+    guards
+  };
+};
+var policyPath = (root) => toAbsolutePath(join3(root, POLICY_FILE));
+var loadPolicy = (runtime, root) => {
+  const text6 = runtime.readText(policyPath(root));
+  return text6.ok ? parsePolicy(text6.value) : DEFAULT_POLICY;
+};
+
 // src/install/managed-block.ts
 var lineBreak = (text6) => text6.includes("\r\n") ? "\r\n" : "\n";
 var blockRange = (lines3, markers) => {
@@ -594,6 +1027,11 @@ var withoutManagedBlock = (text6, markers) => {
 // src/install/templates/en.ts
 var en = {
   configHeader: "Finite Monkey project settings. Commit this file. `finitemonkey update` keeps your edits.",
+  policyHeader: [
+    "Guard policy for this project. Modes: off, shadow (record what it would block), active.",
+    "The guards for secrets, production, lost git work and false done stay active whatever this file says.",
+    "A guard missing from this list starts in shadow and is promoted after promoteAfter firings without a false positive."
+  ],
   agentsBlock: ({ gate, doctor }) => [
     "## Finite Monkey",
     "",
@@ -616,6 +1054,11 @@ var en = {
 // src/install/templates/es.ts
 var es = {
   configHeader: "Configuración de Finite Monkey en este proyecto. Versiona este archivo. `finitemonkey update` conserva tus cambios.",
+  policyHeader: [
+    "Política de los guards de este proyecto. Modos: off, shadow (registra lo que bloquearía), active.",
+    "Los guards de secretos, producción, trabajo de git perdido y falso terminado siguen activos diga lo que diga este archivo.",
+    "Un guard que no está en esta lista empieza en shadow y se promueve tras promoteAfter disparos sin falso positivo."
+  ],
   agentsBlock: ({ gate, doctor }) => [
     "## Finite Monkey",
     "",
@@ -638,6 +1081,11 @@ var es = {
 // src/install/templates/pt-BR.ts
 var ptBR = {
   configHeader: "Configuração do Finite Monkey neste projeto. Versione este arquivo. O `finitemonkey update` mantém suas edições.",
+  policyHeader: [
+    "Política dos guards deste projeto. Modos: off, shadow (registra o que bloquearia), active.",
+    "Os guards de segredos, produção, trabalho de git perdido e falso pronto ficam ativos, diga o que disser este arquivo.",
+    "Um guard que não está nesta lista começa em shadow e é promovido depois de promoteAfter disparos sem falso positivo."
+  ],
   agentsBlock: ({ gate, doctor }) => [
     "## Finite Monkey",
     "",
@@ -694,8 +1142,8 @@ var execForm = (runner, event) => {
 };
 var hookHandler = (runner, spec2, failClosedSupported) => {
   const failure4 = spec2.guard && failClosedSupported ? { onFailure: "block" } : {};
-  const { command, args } = execForm(runner, spec2.event);
-  return { type: "command", command, args, timeout: spec2.timeout, ...failure4 };
+  const { command, args: args2 } = execForm(runner, spec2.event);
+  return { type: "command", command, args: args2, timeout: spec2.timeout, ...failure4 };
 };
 var OWN_SHELL = /(^|[\s/"'])finitemonkey(@[^\s"]+|\.mjs|\.cmd|\.exe)?"?\s+hook\s/;
 var OWN_SCRIPT = /finitemonkey(\.mjs|\.cmd|\.exe)?$/;
@@ -704,19 +1152,19 @@ var isOwnHandler = (handler) => {
   if (!isRecord(handler)) return false;
   const command = handler["command"];
   if (typeof command !== "string") return false;
-  const args = stringsOf(handler["args"]);
-  if (args.length === 0) return OWN_SHELL.test(`${command} `);
-  const hookAt = args.indexOf("hook");
+  const args2 = stringsOf(handler["args"]);
+  if (args2.length === 0) return OWN_SHELL.test(`${command} `);
+  const hookAt = args2.indexOf("hook");
   if (hookAt < 0) return false;
-  const target = hookAt === 0 ? command : args[hookAt - 1] ?? "";
+  const target = hookAt === 0 ? command : args2[hookAt - 1] ?? "";
   return OWN_SCRIPT.test(target);
 };
 
 // src/install/skill-template.ts
-var cliCommand = (runner, args) => {
-  if (runner.kind === "local") return `node ${LOCAL_BIN} ${args}`;
-  if (runner.kind === "vendored") return `node ${VENDOR_BIN} ${args}`;
-  return isScript(runner.path) ? `node "${runner.path}" ${args}` : `"${runner.path}" ${args}`;
+var cliCommand = (runner, args2) => {
+  if (runner.kind === "local") return `node ${LOCAL_BIN} ${args2}`;
+  if (runner.kind === "vendored") return `node ${VENDOR_BIN} ${args2}`;
+  return isScript(runner.path) ? `node "${runner.path}" ${args2}` : `"${runner.path}" ${args2}`;
 };
 var verifySkillTemplate = (runner, lang) => {
   const skill = TEMPLATES[lang].verifySkill;
@@ -856,7 +1304,7 @@ var DENY_FLOOR = {
 var DENY_RULES = [...DENY_FLOOR.secrets, ...DENY_FLOOR.git, ...DENY_FLOOR.proof];
 
 // src/install/detect.ts
-import { join as join2 } from "node:path";
+import { join as join4 } from "node:path";
 
 // src/install/json-text.ts
 var DEFAULT_STYLE = { indent: "  ", finalNewline: true };
@@ -868,11 +1316,11 @@ var renderJson = (value, style) => `${JSON.stringify(value, null, style.indent)}
 var parseSettings = (text6) => text6 === void 0 || text6.trim() === "" ? { ok: true, value: {} } : parseJsonObject(text6);
 var asList = (value) => Array.isArray(value) ? value : [];
 var asRecord = (value) => isRecord(value) ? value : {};
-var setKey = (record2, key, value) => {
-  if (!(key in record2)) return value === void 0 ? record2 : { ...record2, [key]: value };
+var setKey = (record3, key, value) => {
+  if (!(key in record3)) return value === void 0 ? record3 : { ...record3, [key]: value };
   return Object.fromEntries(
-    Object.entries(record2).flatMap(([name, current]) => {
-      if (name !== key) return [[name, current]];
+    Object.entries(record3).flatMap(([name, current2]) => {
+      if (name !== key) return [[name, current2]];
       return value === void 0 ? [] : [[name, value]];
     })
   );
@@ -949,7 +1397,7 @@ var scopeAuthorities = (text6, source) => {
 var userSettingsText = (project, env) => {
   const home = env["CLAUDE_CONFIG_DIR"] ?? env["HOME"] ?? env["USERPROFILE"];
   if (home === void 0) return void 0;
-  const file = env["CLAUDE_CONFIG_DIR"] === void 0 ? join2(home, ".claude", "settings.json") : join2(home, "settings.json");
+  const file = env["CLAUDE_CONFIG_DIR"] === void 0 ? join4(home, ".claude", "settings.json") : join4(home, "settings.json");
   const text6 = project.runtime.readText(toAbsolutePath(file));
   return text6.ok ? text6.value : void 0;
 };
@@ -1041,6 +1489,18 @@ var applyMigrations = (items, previous, version, migrations) => {
 // src/install/migrations/index.ts
 var MIGRATIONS = [];
 
+// src/install/policy-template.ts
+var policyTemplate = (lang) => [
+  `# ${GENERATED_MARKER}`,
+  ...TEMPLATES[lang].policyHeader.map((line2) => `# ${line2}`),
+  "level: standard",
+  "severity: medium",
+  `promoteAfter: ${String(DEFAULT_PROMOTE_AFTER)}`,
+  "guards:",
+  ...OPTIONAL_GUARDS.map((id) => `  ${id}: active`),
+  ""
+].join("\n");
+
 // src/install/settings-merge.ts
 var SETTINGS_SCHEMA_URL = "https://json.schemastore.org/claude-code-settings.json";
 var ATTRIBUTION_OFF = { commit: "", pr: "", sessionUrl: false };
@@ -1095,15 +1555,15 @@ var withPermissions = (settings, lists) => {
 var missing = (wanted, existing) => wanted.filter((rule) => !existing.includes(rule));
 var withoutAdded = (existing, added) => existing.filter((rule) => typeof rule !== "string" || !added.includes(rule));
 var ownHookMatcher = (recorded) => (handler) => isOwnHandler(handler) || recorded.some((own) => JSON.stringify(own) === JSON.stringify(handler));
-var mergeSettings = (current, wanted, recorded) => {
-  const schema = Object.keys(current).length === 0;
-  const base = schema ? { $schema: SETTINGS_SCHEMA_URL } : current;
+var mergeSettings = (current2, wanted, recorded) => {
+  const schema = Object.keys(current2).length === 0;
+  const base = schema ? { $schema: SETTINGS_SCHEMA_URL } : current2;
   const hooks = mergeHooks(asRecord(base["hooks"]), ownHookMatcher(recorded), wanted.hooks);
   const permissions = asRecord(base["permissions"]);
   const existingDeny = asList(permissions["deny"]);
   const existingAsk = asList(permissions["ask"]);
   const deny2 = missing(wanted.deny, existingDeny);
-  const ask = missing(wanted.ask, existingAsk);
+  const ask2 = missing(wanted.ask, existingAsk);
   const blockReads = !(BLOCK_READS in permissions);
   const attribution = wanted.attributionOff && !("attribution" in base);
   const marketplace = wanted.marketplace && !hasEntry(base, "extraKnownMarketplaces", MARKETPLACE_KEY);
@@ -1111,21 +1571,21 @@ var mergeSettings = (current, wanted, recorded) => {
   const language = "language" in base ? void 0 : wanted.language;
   let settings = withPermissions(withHooks(base, hooks), {
     deny: [...existingDeny, ...deny2],
-    ask: [...existingAsk, ...ask],
+    ask: [...existingAsk, ...ask2],
     blockReads: blockReads ? true : permissions[BLOCK_READS]
   });
   if (attribution) settings = { ...settings, attribution: ATTRIBUTION_OFF };
   if (marketplace) settings = withEntry(settings, "extraKnownMarketplaces", MARKETPLACE_KEY, MARKETPLACE_ENTRY);
   if (plugin) settings = withEntry(settings, "enabledPlugins", PLUGIN_ID, true);
   if (language !== void 0) settings = { ...settings, language };
-  const added = { schema, deny: deny2, ask, blockReads, attribution, marketplace, plugin };
+  const added = { schema, deny: deny2, ask: ask2, blockReads, attribution, marketplace, plugin };
   return { settings, added: language === void 0 ? added : { ...added, language } };
 };
 var sameAttribution = (value) => JSON.stringify(value) === JSON.stringify(ATTRIBUTION_OFF);
-var unmergeSettings = (current, added, recorded) => {
-  const hooks = mergeHooks(asRecord(current["hooks"]), ownHookMatcher(recorded), {});
-  const permissions = asRecord(current["permissions"]);
-  let settings = withPermissions(withHooks(current, hooks), {
+var unmergeSettings = (current2, added, recorded) => {
+  const hooks = mergeHooks(asRecord(current2["hooks"]), ownHookMatcher(recorded), {});
+  const permissions = asRecord(current2["permissions"]);
+  let settings = withPermissions(withHooks(current2, hooks), {
     deny: withoutAdded(asList(permissions["deny"]), added.deny),
     ask: withoutAdded(asList(permissions["ask"]), added.ask),
     blockReads: added.blockReads && permissions[BLOCK_READS] === true ? void 0 : permissions[BLOCK_READS]
@@ -1202,8 +1662,8 @@ var wantedHooks = (detection) => Object.fromEntries(
 );
 var settingsItem = (project, detection, input, previous) => {
   const before = project.read(SETTINGS_FILE);
-  const current = parseSettings(before);
-  if (!current.ok) return reject({ kind: "settings", detail: current.error });
+  const current2 = parseSettings(before);
+  if (!current2.ok) return reject({ kind: "settings", detail: current2.error });
   const hooks = wantedHooks(detection);
   const wanted = {
     hooks,
@@ -1213,7 +1673,7 @@ var settingsItem = (project, detection, input, previous) => {
     marketplace: input.marketplace,
     language: input.claudeLanguage
   };
-  const merged = mergeSettings(current.value, wanted, previous?.handlers ?? []);
+  const merged = mergeSettings(current2.value, wanted, previous?.handlers ?? []);
   const after = renderJson(merged.settings, before === void 0 ? DEFAULT_STYLE : styleOf(before));
   return accept({
     path: SETTINGS_FILE,
@@ -1254,7 +1714,8 @@ var generatedItem = (project, file, previous) => {
 var generatedFiles = (input, runner, vendor) => {
   const own = [
     { path: CONFIG_FILE, template: configTemplate(input.preset, input.lang), isOurs: hasMarker },
-    { path: VERIFY_SKILL, template: verifySkillTemplate(runner, input.lang), isOurs: isOwnSkill }
+    { path: VERIFY_SKILL, template: verifySkillTemplate(runner, input.lang), isOurs: isOwnSkill },
+    { path: POLICY_FILE, template: policyTemplate(input.lang), isOurs: hasMarker }
   ];
   if (!vendor) return accept(own);
   if (input.bundle === void 0) return reject({ kind: "bundle", detail: "the running finitemonkey is not a bundle" });
@@ -1428,9 +1889,9 @@ var detectLang = (flag2, env, settings = {}) => {
 };
 
 // src/install/project.ts
-import { dirname as dirname4, join as join3 } from "node:path";
+import { dirname as dirname4, join as join5 } from "node:path";
 var projectAt = (root, runtime) => {
-  const abs = (relative9) => toAbsolutePath(join3(root, ...relative9.split("/")));
+  const abs = (relative9) => toAbsolutePath(join5(root, ...relative9.split("/")));
   return {
     root,
     runtime,
@@ -1444,12 +1905,12 @@ var projectAt = (root, runtime) => {
   };
 };
 var findGitRoot = (start, runtime) => {
-  let current = start;
+  let current2 = start;
   for (; ; ) {
-    if (runtime.stat(toAbsolutePath(join3(current, ".git"))) !== void 0) return toAbsolutePath(current);
-    const parent = dirname4(current);
-    if (parent === current) return void 0;
-    current = parent;
+    if (runtime.stat(toAbsolutePath(join5(current2, ".git"))) !== void 0) return toAbsolutePath(current2);
+    const parent = dirname4(current2);
+    if (parent === current2) return void 0;
+    current2 = parent;
   }
 };
 
@@ -1547,7 +2008,7 @@ var applyFixes = (ctx, write3) => {
 };
 
 // src/doctor/report-file.ts
-import { join as join5 } from "node:path";
+import { join as join7 } from "node:path";
 
 // src/evidence/log.ts
 var logEvent = (runtime, paths, event, data) => runtime.appendText(paths.log, `${JSON.stringify({ at: runtime.now(), event, ...data })}
@@ -2014,11 +2475,11 @@ var maskDeep = (value) => {
 };
 
 // src/task/paths.ts
-import { join as join4 } from "node:path";
+import { join as join6 } from "node:path";
 var FM_DIR = ".finitemonkey";
 var fmPaths = (root) => {
-  const dir = toAbsolutePath(join4(root, FM_DIR));
-  const at = (...parts) => toAbsolutePath(join4(dir, ...parts));
+  const dir = toAbsolutePath(join6(root, FM_DIR));
+  const at = (...parts) => toAbsolutePath(join6(dir, ...parts));
   return {
     root,
     dir,
@@ -2036,8 +2497,8 @@ var fmPaths = (root) => {
 var HOOK_FAILURE_EVENT = "hook.failed";
 var FAILURES = ["failed_open", "failed_closed", "stop_released"];
 var MAX_DETAIL = 500;
-var logHookFailure = (ctx, event, outcome) => {
-  if (!FAILURES.includes(outcome.verdict)) return;
+var logHookFailure = (ctx, event, outcome2) => {
+  if (!FAILURES.includes(outcome2.verdict)) return;
   const fromEnv = ctx.env["CLAUDE_PROJECT_DIR"];
   const root = fromEnv === void 0 ? findGitRoot(ctx.cwd, ctx.runtime) : toAbsolutePath(fromEnv);
   if (root === void 0) return;
@@ -2045,8 +2506,8 @@ var logHookFailure = (ctx, event, outcome) => {
   if (ctx.runtime.stat(paths.dir)?.kind !== "dir") return;
   logEvent(ctx.runtime, paths, HOOK_FAILURE_EVENT, {
     hook: event,
-    verdict: outcome.verdict,
-    detail: maskText(outcome.stderr.trim()).slice(0, MAX_DETAIL)
+    verdict: outcome2.verdict,
+    detail: maskText(outcome2.stderr.trim()).slice(0, MAX_DETAIL)
   });
 };
 
@@ -2254,16 +2715,16 @@ var reportMarkdown = (env, ctx, envelope) => {
   ];
   return maskText(withoutHome(lines3.join("\n"), env.runtime.homeDir()));
 };
-var reportPath = (env) => toAbsolutePath(join5(env.root, ...REPORTS_DIR.split("/"), `doctor-${stamp(env.runtime.now())}.md`));
+var reportPath = (env) => toAbsolutePath(join7(env.root, ...REPORTS_DIR.split("/"), `doctor-${stamp(env.runtime.now())}.md`));
 
 // src/install/plugin-yield.ts
-import { join as join6 } from "node:path";
+import { join as join8 } from "node:path";
 var PLUGIN_VIA = "plugin";
 var YIELD_STDOUT = `${JSON.stringify({ continue: true })}
 `;
 var projectOwnsHooks = (ctx) => {
   const root = ctx.env["CLAUDE_PROJECT_DIR"] ?? ctx.cwd;
-  const text6 = ctx.runtime.readText(toAbsolutePath(join6(root, ...SETTINGS_FILE.split("/"))));
+  const text6 = ctx.runtime.readText(toAbsolutePath(join8(root, ...SETTINGS_FILE.split("/"))));
   if (!text6.ok) return false;
   const parsed = parseJsonObject(text6.value);
   return parsed.ok && ownHandlersIn(parsed.value) > 0;
@@ -2277,7 +2738,7 @@ var STABLE_PLUGIN_ID = `${PLUGIN_NAME}@${MARKETPLACE_NAME}`;
 var NEXT_PLUGIN_ID = `${PLUGIN_NAME}@${NEXT_MARKETPLACE_NAME}`;
 
 // src/doctor/settings.ts
-import { join as join7 } from "node:path";
+import { join as join9 } from "node:path";
 var MANAGED = {
   darwin: "/Library/Application Support/ClaudeCode/managed-settings.json",
   linux: "/etc/claude-code/managed-settings.json",
@@ -2286,7 +2747,7 @@ var MANAGED = {
 var userSettingsPath = ({ env, runtime }) => {
   const configDir = env["CLAUDE_CONFIG_DIR"];
   return toAbsolutePath(
-    configDir === void 0 ? join7(runtime.homeDir(), ".claude", "settings.json") : join7(configDir, "settings.json")
+    configDir === void 0 ? join9(runtime.homeDir(), ".claude", "settings.json") : join9(configDir, "settings.json")
   );
 };
 var settingsPaths = (env) => {
@@ -2294,8 +2755,8 @@ var settingsPaths = (env) => {
   return [
     ...managed === void 0 ? [] : [{ scope: "managed", path: toAbsolutePath(managed) }],
     { scope: "user", path: userSettingsPath(env) },
-    { scope: "project", path: toAbsolutePath(join7(env.root, ".claude", "settings.json")) },
-    { scope: "local", path: toAbsolutePath(join7(env.root, ".claude", "settings.local.json")) }
+    { scope: "project", path: toAbsolutePath(join9(env.root, ".claude", "settings.json")) },
+    { scope: "local", path: toAbsolutePath(join9(env.root, ".claude", "settings.local.json")) }
   ];
 };
 var readSettings = (env) => settingsPaths(env).flatMap(({ scope: scope2, path }) => {
@@ -2439,7 +2900,7 @@ var checkClaudeSettings = (env) => {
 };
 
 // src/doctor/environment.ts
-import { join as join8 } from "node:path";
+import { join as join10 } from "node:path";
 var AUTH_VARIABLES = [
   "ANTHROPIC_API_KEY",
   "ANTHROPIC_AUTH_TOKEN",
@@ -2459,7 +2920,7 @@ var checkSandbox = (env) => {
   }
   if (os === "macos") return [finding("sandbox", "ok", "doctor.sandbox.ok")];
   if (os === "other") return [];
-  const missing2 = SANDBOX_TOOLS.filter(({ command, args }) => !env.runtime.probe(command, args, PROBE_MS2).found).map(
+  const missing2 = SANDBOX_TOOLS.filter(({ command, args: args2 }) => !env.runtime.probe(command, args2, PROBE_MS2).found).map(
     ({ command }) => command
   );
   if (missing2.length === 0) return [finding("sandbox", "ok", "doctor.sandbox.ok")];
@@ -2477,7 +2938,7 @@ var pathDirs = ({ env, platform }) => {
 var copiesOnPath = (env) => {
   const names = EXECUTABLES[env.platform] ?? ["finitemonkey"];
   const found = pathDirs(env).flatMap(
-    (dir) => names.map((name) => toAbsolutePath(join8(dir, name))).filter((path) => env.runtime.stat(path)?.kind === "file").map((path) => env.runtime.realpath(path))
+    (dir) => names.map((name) => toAbsolutePath(join10(dir, name))).filter((path) => env.runtime.stat(path)?.kind === "file").map((path) => env.runtime.realpath(path))
   );
   const byDir = new Map(found.map((path) => [path.replace(/\.(cmd|exe|ps1)$/i, ""), path]));
   return [...byDir.values()];
@@ -2511,7 +2972,7 @@ var checkAuthVariables = ({ env, platform }) => {
 };
 
 // src/doctor/hooks.ts
-import { join as join29 } from "node:path";
+import { join as join31 } from "node:path";
 
 // src/hooks/events.ts
 var HOOK_EVENTS = [
@@ -2558,9 +3019,9 @@ var deadlineFor = (event, raw) => {
 };
 
 // src/hooks/fields.ts
-var textField = (record2, ...names) => {
+var textField = (record3, ...names) => {
   for (const name of names) {
-    const value = record2[name];
+    const value = record3[name];
     if (typeof value === "string") return value;
   }
   return void 0;
@@ -2655,8 +3116,8 @@ var closeTask = (state, id) => assemble({
 
 // src/guards/release/grants.ts
 var GRANT_MINUTES = 30;
-var text2 = (record2, key) => {
-  const value = record2[key];
+var text2 = (record3, key) => {
+  const value = record3[key];
   return typeof value === "string" ? value : void 0;
 };
 var toGrant = (value) => {
@@ -3180,10 +3641,10 @@ var withAssignments = (stage) => {
   }
   return { ...stage, argv: stage.argv.slice(index), env };
 };
-var skipOptions = (args, wrapper) => {
+var skipOptions = (args2, wrapper) => {
   let index = 0;
-  while (index < args.length) {
-    const arg = args[index] ?? "";
+  while (index < args2.length) {
+    const arg = args2[index] ?? "";
     if (arg === "--") return index + 1 + wrapper.positionals;
     if (!arg.startsWith("-") || arg === "-") break;
     if (wrapper.queries.has(arg)) return void 0;
@@ -3213,33 +3674,33 @@ var envCommand = (stage) => {
   return printsEnvironment ? { kind: "command", stage, extra: [] } : shift(stage, index, "env");
 };
 var shellScript = (stage, name, stdin) => {
-  const args = stage.argv.slice(1);
+  const args2 = stage.argv.slice(1);
   let index = 0;
   let command = false;
-  while (index < args.length && /^[-+]/.test(args[index] ?? "")) {
-    const arg = args[index] ?? "";
+  while (index < args2.length && /^[-+]/.test(args2[index] ?? "")) {
+    const arg = args2[index] ?? "";
     if (/^-[A-Za-z]*c[A-Za-z]*$/.test(arg)) command = true;
     index += SHELL_WITH_VALUE.has(arg) ? 2 : 1;
   }
-  const script = args[index];
+  const script = args2[index];
   if (command && script !== void 0) return { kind: "script", script, dialect: "bash", stage: shift(stage, 0, name) };
   if (script === void 0 && stdin !== void 0) return { kind: "script", script: stdin, dialect: "bash", stage };
   return void 0;
 };
 var decodeEncoded = (value) => Buffer.from(value, "base64").toString("utf16le");
 var powershellScript = (stage, name) => {
-  const args = stage.argv.slice(1);
-  const at = args.findIndex((arg) => /^[-/](?:c|co|com|comm|comma|comman|command)$/i.test(arg));
-  const encoded = args.findIndex((arg) => /^[-/](?:e|ec|enc|encodedcommand)$/i.test(arg));
+  const args2 = stage.argv.slice(1);
+  const at = args2.findIndex((arg) => /^[-/](?:c|co|com|comm|comma|comman|command)$/i.test(arg));
+  const encoded = args2.findIndex((arg) => /^[-/](?:e|ec|enc|encodedcommand)$/i.test(arg));
   if (at >= 0) {
     return {
       kind: "script",
-      script: args.slice(at + 1).join(" "),
+      script: args2.slice(at + 1).join(" "),
       dialect: "powershell",
       stage: shift(stage, 0, name)
     };
   }
-  const value = encoded >= 0 ? args[encoded + 1] : void 0;
+  const value = encoded >= 0 ? args2[encoded + 1] : void 0;
   if (value !== void 0) {
     return { kind: "script", script: decodeEncoded(value), dialect: "powershell", stage: shift(stage, 0, name) };
   }
@@ -3298,10 +3759,10 @@ var PS_ENV = /^\$env:([A-Za-z_][A-Za-z0-9_]*)=?(.*)$/is;
 var CHANGES_DIR = /* @__PURE__ */ new Set(["cd", "pushd", "set-location", "push-location"]);
 var lex = (text6, language) => language === "bash" ? lexBash(text6) : lexPowerShell(text6, language === "cmd");
 var isWindowsAbsolute = (path) => /^[A-Za-z]:\//.test(path);
-var joinDir = (current, target) => {
+var joinDir = (current2, target) => {
   const next2 = toPosixPath(target);
   if (next2.startsWith("/") || isWindowsAbsolute(next2) || next2.startsWith("~")) return next2;
-  return current === void 0 ? posix.normalize(next2) : posix.join(current, next2);
+  return current2 === void 0 ? posix.normalize(next2) : posix.join(current2, next2);
 };
 var assignments = (words, language) => {
   if (language !== "bash") {
@@ -3414,24 +3875,24 @@ var COMMIT_VALUE_SHORTS = /* @__PURE__ */ new Set(["m", "F", "C", "c", "t"]);
 var VERIFY_SUBCOMMANDS = /* @__PURE__ */ new Set(["commit", "push", "merge", "am", "rebase", "cherry-pick", "revert", "pull"]);
 var isHooksPath = (value) => /^core\.hookspath(=|$)/i.test(value);
 var envFindings = (command) => {
-  const pairs = Object.entries(command.env);
+  const pairs2 = Object.entries(command.env);
   const exported = command.argv[0] === "export" ? command.argv.slice(1).map((arg) => arg.split("=", 2)) : [];
-  return [...pairs, ...exported].filter(([name = ""]) => HOOK_ENV.test(name)).map(([name = "", value = ""]) => ({ kind: "hook_env", detail: `${name}=${value}` }));
+  return [...pairs2, ...exported].filter(([name = ""]) => HOOK_ENV.test(name)).map(([name = "", value = ""]) => ({ kind: "hook_env", detail: `${name}=${value}` }));
 };
-var splitGit = (args) => {
+var splitGit = (args2) => {
   let index = 0;
   const globals = [];
-  while (index < args.length && (args[index] ?? "").startsWith("-")) {
-    const arg = args[index] ?? "";
+  while (index < args2.length && (args2[index] ?? "").startsWith("-")) {
+    const arg = args2[index] ?? "";
     globals.push(arg);
-    if (GIT_VALUE_OPTIONS.has(arg)) globals.push(args[index + 1] ?? "");
+    if (GIT_VALUE_OPTIONS.has(arg)) globals.push(args2[index + 1] ?? "");
     index += GIT_VALUE_OPTIONS.has(arg) ? 2 : 1;
   }
-  return { globals, rest: args.slice(index) };
+  return { globals, rest: args2.slice(index) };
 };
-var commitHasShortN = (args) => {
-  for (let index = 0; index < args.length; index += 1) {
-    const arg = args[index] ?? "";
+var commitHasShortN = (args2) => {
+  for (let index = 0; index < args2.length; index += 1) {
+    const arg = args2[index] ?? "";
     if (arg === "--") return false;
     if (!/^-[A-Za-z]/.test(arg)) continue;
     for (const char of arg.slice(1)) {
@@ -3444,8 +3905,8 @@ var commitHasShortN = (args) => {
   }
   return false;
 };
-var gitFindings = (args) => {
-  const { globals, rest } = splitGit(args);
+var gitFindings = (args2) => {
+  const { globals, rest } = splitGit(args2);
   const found = [];
   globals.forEach((arg, index) => {
     if (arg === "-c" && isHooksPath(globals[index + 1] ?? "") || /^--config-env=core\.hookspath/i.test(arg)) {
@@ -3522,16 +3983,16 @@ var GIT_WRITERS = /* @__PURE__ */ new Set(["checkout", "restore", "rm", "mv", "c
 var FM_NAMES2 = /* @__PURE__ */ new Set(["finitemonkey", "fm"]);
 var inline = (argv) => argv.some((arg) => arg === "-e" || arg === "-c" || arg === "--eval");
 var writtenPaths = (command) => {
-  const [name = "", ...args] = command.argv;
-  const operands2 = args.filter((arg) => !arg.startsWith("-"));
-  const ddTargets = args.filter((arg) => arg.startsWith("of=")).map((arg) => arg.slice(3));
+  const [name = "", ...args2] = command.argv;
+  const operands2 = args2.filter((arg) => !arg.startsWith("-"));
+  const ddTargets = args2.filter((arg) => arg.startsWith("of=")).map((arg) => arg.slice(3));
   if (FM_NAMES2.has(name)) return command.redirects;
   if (COPIERS.has(name)) return [...command.redirects, ...operands2.slice(-1)];
   if (WRITERS.has(name)) return [...command.redirects, ...operands2, ...ddTargets];
-  if (IN_PLACE.has(name) && args.some((arg) => /^-[a-zA-Z]*i/.test(arg) || arg.startsWith("--in-place"))) {
+  if (IN_PLACE.has(name) && args2.some((arg) => /^-[a-zA-Z]*i/.test(arg) || arg.startsWith("--in-place"))) {
     return [...command.redirects, ...operands2];
   }
-  if (INTERPRETERS.has(name) && inline(args)) return [...command.redirects, ...args];
+  if (INTERPRETERS.has(name) && inline(args2)) return [...command.redirects, ...args2];
   if (name === "git" && GIT_WRITERS.has(operands2[0] ?? "")) return [...command.redirects, ...operands2.slice(1)];
   return command.redirects;
 };
@@ -3550,14 +4011,14 @@ var bashSelfTargets = (root, commandLine) => parseShell(commandLine).flatMap(
 // src/guards/self/hook.ts
 var targets = (input) => {
   const tool = toolName(input.payload.raw);
-  const args = toolInput(input.payload.raw);
+  const args2 = toolInput(input.payload.raw);
   const root = guardRoot(input);
   if (FILE_TOOLS.has(tool)) {
-    const path = textField(args, "file_path", "notebook_path") ?? "";
+    const path = textField(args2, "file_path", "notebook_path") ?? "";
     const kind = path === "" ? void 0 : selfTarget(root, path);
     return kind === void 0 ? [] : [{ kind, path }];
   }
-  return SHELL_TOOLS.has(tool) ? bashSelfTargets(root, textField(args, "command") ?? "") : [];
+  return SHELL_TOOLS.has(tool) ? bashSelfTargets(root, textField(args2, "command") ?? "") : [];
 };
 var selfGuard = (input) => {
   const found = targets(input);
@@ -3574,7 +4035,7 @@ var selfGuard = (input) => {
 };
 
 // src/guards/tests/hook.ts
-import { join as join9, relative as relative3 } from "node:path";
+import { join as join11, relative as relative3 } from "node:path";
 
 // src/guards/tests/patterns.ts
 var JS_TEST = /(^|\/)(__tests__|__test__)\/|\.(test|spec)\.[cm]?[jt]sx?$|(^|\/)tests?\/.*\.[cm]?[jt]sx?$/;
@@ -3741,19 +4202,19 @@ var read = (input, path) => {
   const text6 = input.runtime.readText(path);
   return text6.ok ? text6.value : void 0;
 };
-var proposed = (tool, args, before) => {
-  if (tool === "Write") return textField(args, "content") ?? "";
-  return before === void 0 ? void 0 : applyEdits(before, editsOf(args));
+var proposed = (tool, args2, before) => {
+  if (tool === "Write") return textField(args2, "content") ?? "";
+  return before === void 0 ? void 0 : applyEdits(before, editsOf(args2));
 };
 var fileViolations = (input, root) => {
   const tool = toolName(input.payload.raw);
-  const args = toolInput(input.payload.raw);
-  const file = textField(args, "file_path") ?? "";
+  const args2 = toolInput(input.payload.raw);
+  const file = textField(args2, "file_path") ?? "";
   if (tool === "NotebookEdit" || file === "") return [];
   const local = localPath(root, file);
   if (!isTestFile(local) && !isProtectedConfig(local)) return [];
   const before = read(input, toAbsolutePath(file, root));
-  const after = proposed(tool, args, before);
+  const after = proposed(tool, args2, before);
   if (after === void 0) return [];
   const accepted2 = readTrust(input.runtime, fmPaths(root)).configs[local];
   if (before === void 0) return compareNewTestFile(local, after);
@@ -3764,7 +4225,7 @@ var shellViolations = (input, root) => {
   return parseShell(command).flatMap(
     (simple) => writtenPaths(simple).flatMap((path) => {
       const local = localPath(root, path);
-      const exists = input.runtime.stat(toAbsolutePath(join9(root, local))) !== void 0;
+      const exists = input.runtime.stat(toAbsolutePath(join11(root, local))) !== void 0;
       if (!exists) return [];
       if (isProtectedConfig(local)) return [{ kind: "config_changed", path: local }];
       return isTestFile(local) ? [{ kind: "test_removed", path: local }] : [];
@@ -3784,20 +4245,20 @@ var testsGuard = (input) => {
 };
 
 // src/gate/hooks/config.ts
-import { join as join11 } from "node:path";
+import { join as join13 } from "node:path";
 
 // src/gate/hooks/common.ts
-import { dirname as dirname5, join as join10 } from "node:path";
+import { dirname as dirname5, join as join12 } from "node:path";
 var DEFAULT_GATE_BUDGET_MS = 3e5;
 var sessionCwd = (input) => input.payload.cwd === void 0 ? input.cwd : toAbsolutePath(input.payload.cwd, input.cwd);
 var MAX_DEPTH2 = 64;
 var findRepoRoot = (runtime, start) => {
-  let current = start;
+  let current2 = start;
   for (let depth = 0; depth < MAX_DEPTH2; depth += 1) {
-    if (runtime.stat(toAbsolutePath(join10(current, ".git"))) !== void 0) return current;
-    const parent = toAbsolutePath(dirname5(current));
-    if (parent === current) return void 0;
-    current = parent;
+    if (runtime.stat(toAbsolutePath(join12(current2, ".git"))) !== void 0) return current2;
+    const parent = toAbsolutePath(dirname5(current2));
+    if (parent === current2) return void 0;
+    current2 = parent;
   }
   return void 0;
 };
@@ -3817,7 +4278,7 @@ var contextOutput = (event, additionalContext, systemMessage) => ({
 var human = (text6) => `finitemonkey: ${text6}`;
 
 // src/gate/hooks/config.ts
-var CONFIG_FILE2 = "config-hooks.json";
+var CONFIG_FILE3 = "config-hooks.json";
 var GUARDED_SOURCES = /* @__PURE__ */ new Set(["user_settings", "project_settings", "local_settings"]);
 var countIn = (value) => {
   if (typeof value === "string") return /\bfinitemonkey\b|\bfm hook\b/.test(value) ? 1 : 0;
@@ -3831,20 +4292,20 @@ var censusOf = (text6) => {
   return { hooks: countIn(parsed.value["hooks"]), disabled: parsed.value["disableAllHooks"] === true };
 };
 var settingsFiles = (paths, env) => [
-  toAbsolutePath(join11(paths.root, ".claude", "settings.json")),
-  toAbsolutePath(join11(paths.root, ".claude", "settings.local.json")),
-  ...env["HOME"] === void 0 ? [] : [toAbsolutePath(join11(env["HOME"], ".claude", "settings.json"))]
+  toAbsolutePath(join13(paths.root, ".claude", "settings.json")),
+  toAbsolutePath(join13(paths.root, ".claude", "settings.local.json")),
+  ...env["HOME"] === void 0 ? [] : [toAbsolutePath(join13(env["HOME"], ".claude", "settings.json"))]
 ];
 var read2 = (runtime, path) => {
   const text6 = runtime.readText(path);
   return text6.ok ? text6.value : void 0;
 };
 var known = (runtime, paths) => {
-  const raw = readJsonFile(runtime, paths.cache(CONFIG_FILE2))?.["hooks"];
+  const raw = readJsonFile(runtime, paths.cache(CONFIG_FILE3))?.["hooks"];
   return isRecord(raw) ? Object.fromEntries(Object.entries(raw).filter((entry2) => typeof entry2[1] === "number")) : {};
 };
 var save = (runtime, paths, counts) => {
-  writeJsonFile(runtime, paths.cache(CONFIG_FILE2), { hooks: { ...counts } });
+  writeJsonFile(runtime, paths.cache(CONFIG_FILE3), { hooks: { ...counts } });
 };
 var recordConfigHooks = (runtime, paths, env) => {
   const counts = Object.fromEntries(
@@ -3964,107 +4425,22 @@ var implicitContract = (files) => {
     acceptance: [
       ...commands,
       ...hasTests ? [] : [{ id: "tests", kind: "tests" }],
-      { id: "placeholders", kind: "placeholders" },
-      { id: "secrets", kind: "secrets" },
-      { id: "prose", kind: "prose" },
-      { id: "worktree", kind: "worktree" },
-      { id: "merge", kind: "merge" },
-      { id: "pr", kind: "pr", requireOpen: false }
-    ],
-    decisionsNeeded: [],
-    implicit: true
-  };
-};
-
-// src/gate/prepare.ts
-import { join as join14 } from "node:path";
-
-// src/git/project-config.ts
-import { join as join12 } from "node:path";
-var CONFIG_FILE3 = ".finitemonkey/config.yml";
-var unquote = (value) => value.trim().replace(/^(["'])(.*)\1$/s, "$2");
-var stripComment = (line2) => {
-  let quote;
-  for (let index = 0; index < line2.length; index += 1) {
-    const char = line2.charAt(index);
-    if (quote === void 0 && (char === '"' || char === "'")) quote = char;
-    else if (char === quote) quote = void 0;
-    else if (quote === void 0 && char === "#" && (index === 0 || /\s/.test(line2.charAt(index - 1)))) {
-      return line2.slice(0, index);
-    }
-  }
-  return line2;
-};
-var flowList = (value) => {
-  const trimmed = value.trim();
-  if (!trimmed.startsWith("[") || !trimmed.endsWith("]")) return void 0;
-  return trimmed.slice(1, -1).split(",").map(unquote).filter((item) => item !== "");
-};
-var keyValue = (body2) => {
-  const match = /^("[^"]*"|'[^']*'|[^:]+?)\s*:(?:\s+(.*))?$/.exec(body2);
-  if (match === null) return void 0;
-  return { key: unquote(match[1] ?? ""), value: match[2] ?? "" };
-};
-var addItem = (frame, item) => {
-  if (frame.key === void 0) return;
-  const parent = frame.tree[frame.key];
-  if (Array.isArray(parent)) parent.push(item);
-  else frame.tree[frame.key] = [item];
-};
-var placeLine = (stack, indent, body2) => {
-  while (stack.length > 1 && (stack[stack.length - 1]?.indent ?? 0) >= indent && !body2.startsWith("- ")) stack.pop();
-  const top = stack[stack.length - 1];
-  if (top === void 0) return;
-  if (body2.startsWith("- ")) {
-    addItem(top, unquote(body2.slice(2)));
-    return;
-  }
-  const pair = keyValue(body2);
-  if (pair === void 0) return;
-  const parentTree = top.key === void 0 ? top.tree : ensureTree(top.tree, top.key);
-  if (pair.value === "") {
-    stack.push({ indent, tree: parentTree, key: pair.key });
-    return;
-  }
-  parentTree[pair.key] = flowList(pair.value) ?? unquote(pair.value);
-};
-var ensureTree = (tree, key) => {
-  const existing = tree[key];
-  if (existing !== void 0 && typeof existing !== "string" && !Array.isArray(existing)) return existing;
-  const fresh3 = {};
-  tree[key] = fresh3;
-  return fresh3;
-};
-var parseConfigYaml = (text6) => {
-  const root = {};
-  const stack = [{ indent: -1, tree: root, key: void 0 }];
-  for (const raw of text6.split(/\r?\n/)) {
-    const line2 = stripComment(raw).trimEnd();
-    if (line2.trim() === "" || line2.trim() === "---") continue;
-    const indent = line2.length - line2.trimStart().length;
-    placeLine(stack, indent, line2.trim());
-  }
-  return root;
-};
-var isTree = (node) => typeof node === "object" && !Array.isArray(node);
-var configAt = (tree, ...path) => path.reduce((node, key) => isTree(node) ? node[key] : void 0, tree);
-var configList = (tree, ...path) => {
-  const node = configAt(tree, ...path);
-  if (typeof node === "string") return node === "" ? [] : [node];
-  return Array.isArray(node) ? node.filter((item) => typeof item === "string") : [];
-};
-var configMap = (tree, ...path) => {
-  const node = configAt(tree, ...path);
-  if (!isTree(node)) return {};
-  return Object.fromEntries(
-    Object.entries(node).filter((entry2) => typeof entry2[1] === "string")
-  );
-};
-var loadProjectConfig = (runtime, root) => {
-  const text6 = runtime.readText(toAbsolutePath(join12(root, CONFIG_FILE3)));
-  return text6.ok ? parseConfigYaml(text6.value) : {};
+      { id: "placeholders", kind: "placeholders" },
+      { id: "secrets", kind: "secrets" },
+      { id: "prose", kind: "prose" },
+      { id: "worktree", kind: "worktree" },
+      { id: "merge", kind: "merge" },
+      { id: "callers", kind: "callers" },
+      { id: "pr", kind: "pr", requireOpen: false }
+    ],
+    decisionsNeeded: [],
+    implicit: true
+  };
 };
 
+// src/gate/prepare.ts
+import { join as join15 } from "node:path";
+
 // src/core/yaml/scalar.ts
 var ESCAPES = {
   '"': '"',
@@ -4343,8 +4719,8 @@ var TASK_ID = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
 var TASK_SCHEMA = "finitemonkey/task@1";
 
 // src/task/validate.ts
-var str = (record2, key, at, issues, required) => {
-  const value = record2[key];
+var str = (record3, key, at, issues, required) => {
+  const value = record3[key];
   if (value === void 0 || value === null) {
     if (required) issues.push(`${at}${key}: required`);
     return void 0;
@@ -4355,8 +4731,8 @@ var str = (record2, key, at, issues, required) => {
   }
   return value;
 };
-var positive = (record2, key, at, issues) => {
-  const value = record2[key];
+var positive2 = (record3, key, at, issues) => {
+  const value = record3[key];
   if (value === void 0 || value === null) return void 0;
   if (typeof value === "number" && Number.isInteger(value) && value > 0) return value;
   issues.push(`${at}${key}: must be a positive integer`);
@@ -4375,19 +4751,35 @@ var gitRequire = (value, at, issues) => {
   if (known2.some((item) => item === void 0)) issues.push(`${at}: use ${GIT_REQUIREMENTS.join(", ")}`);
   return known2.filter((item) => item !== void 0);
 };
-var checkFields = (record2, kind, at, issues) => {
-  const run4 = str(record2, "run", at, issues, kind === "command");
-  const timeoutS = positive(record2, "timeout_s", at, issues);
-  const description = str(record2, "description", at, issues, kind === "manual");
-  const require2 = kind === "git" ? gitRequire(record2["require"] ?? ["committed"], `${at}require`, issues) : void 0;
-  const open = record2["require_open"];
+var appFields = (record3, kind, at, issues) => {
+  const port = positive2(record3, "port", at, issues);
+  if (kind === "runtime" && port === void 0) issues.push(`${at}port: required`);
+  if (port !== void 0 && port > 65535) issues.push(`${at}port: must be at most 65535`);
+  const status = positive2(record3, "status", at, issues);
+  const route = str(record3, "route", at, issues, false);
+  const body2 = str(record3, "body", at, issues, false);
+  return {
+    ...port === void 0 ? {} : { port },
+    ...route === void 0 ? {} : { route },
+    ...status === void 0 ? {} : { status },
+    ...body2 === void 0 ? {} : { body: body2 }
+  };
+};
+var checkFields = (record3, kind, at, issues) => {
+  const run4 = str(record3, "run", at, issues, kind === "command");
+  const timeoutS = positive2(record3, "timeout_s", at, issues);
+  const description = str(record3, "description", at, issues, kind === "manual");
+  const require2 = kind === "git" ? gitRequire(record3["require"] ?? ["committed"], `${at}require`, issues) : void 0;
+  const app = appFields(record3, kind, at, issues);
+  const open = record3["require_open"];
   if (open !== void 0 && typeof open !== "boolean") issues.push(`${at}require_open: must be true or false`);
   return {
     ...run4 === void 0 ? {} : { run: run4 },
     ...timeoutS === void 0 ? {} : { timeoutS },
     ...description === void 0 ? {} : { description },
     ...require2 === void 0 ? {} : { require: require2 },
-    ...typeof open === "boolean" ? { requireOpen: open } : {}
+    ...typeof open === "boolean" ? { requireOpen: open } : {},
+    ...app
   };
 };
 var acceptanceItem = (value, index, issues) => {
@@ -4425,8 +4817,8 @@ var scope = (value, issues) => {
     ...files === void 0 ? {} : { files },
     ...lines3 === void 0 ? {} : { lines: lines3 }
   }))({
-    files: positive(budget, "files", "scope.diff_budget.", issues),
-    lines: positive(budget, "lines", "scope.diff_budget.", issues)
+    files: positive2(budget, "files", "scope.diff_budget.", issues),
+    lines: positive2(budget, "lines", "scope.diff_budget.", issues)
   }) : void 0;
   if (budget !== void 0 && budget !== null && !isRecord(budget)) issues.push("scope.diff_budget: must be a mapping");
   const protectedValue = value["tests_protected"];
@@ -4451,6 +4843,7 @@ var validateContract = (value, implicit = false) => {
   const contractScope = scope(value["scope"], issues);
   const checks = acceptance(value["acceptance"], issues);
   const decisionsNeeded = strings2(value["decisions_needed"], "decisions_needed", issues);
+  const callersIgnore = strings2(value["callers_ignore"], "callers_ignore", issues);
   if (issues.length > 0 || id === void 0 || goal === void 0 || size === void 0) return reject(issues);
   return accept({
     id,
@@ -4460,6 +4853,7 @@ var validateContract = (value, implicit = false) => {
     scope: contractScope,
     acceptance: checks,
     decisionsNeeded,
+    ...callersIgnore.length === 0 ? {} : { callersIgnore },
     implicit
   });
 };
@@ -4476,7 +4870,7 @@ var parseContract = (id, text6) => {
   if (valid.value.id !== id) return reject({ kind: "invalid", id, issues: [`id: must match the file name (${id})`] });
   return accept(valid.value);
 };
-var pick = (lock, sources, id) => {
+var pick2 = (lock, sources, id) => {
   const approved = lock.approved[id];
   if (approved !== void 0) return { text: approved, source: "lock" };
   const base = sources.base(taskRelative(id));
@@ -4487,7 +4881,7 @@ var pick = (lock, sources, id) => {
 var loadTask = (files, paths, sources, id) => {
   if (!TASK_ID.test(id)) return reject({ kind: "not_found", id });
   const lock = readTrust(files, paths);
-  const chosen = pick(lock, sources, id);
+  const chosen = pick2(lock, sources, id);
   if (chosen === void 0) return reject({ kind: "not_found", id });
   const parsed = parseContract(id, chosen.text);
   if (!parsed.ok) return parsed;
@@ -4542,19 +4936,19 @@ var readBaseline = (runtime, paths) => {
 var writeBaseline = (runtime, paths, treeHash2, checks) => writeJsonFile(runtime, paths.cache(BASELINE_FILE), { treeHash: treeHash2, checks: { ...checks } }).ok;
 
 // src/gate/diff-shape.ts
-import { join as join13 } from "node:path";
+import { join as join14 } from "node:path";
 
 // src/gate/git.ts
 var EMPTY_TREE = "4b825dc642cb6eb9a060e54bf8d69288fbee4904";
 var GIT_TIMEOUT_MS = 15e3;
 var EXCLUDE_FM = `:(exclude)${FM_DIR}`;
 var gitAt = (runtime, cwd) => {
-  const run4 = (args) => runtime.exec({ command: "git", args: ["-c", "core.quotepath=off", ...args], cwd, timeoutMs: GIT_TIMEOUT_MS });
+  const run4 = (args2) => runtime.exec({ command: "git", args: ["-c", "core.quotepath=off", ...args2], cwd, timeoutMs: GIT_TIMEOUT_MS });
   return {
     cwd,
     run: run4,
-    out: (args) => {
-      const result = run4(args);
+    out: (args2) => {
+      const result = run4(args2);
       return result.found && result.exitCode === 0 ? result.stdout : void 0;
     }
   };
@@ -4649,7 +5043,7 @@ var aheadOfUpstream = (git) => {
 
 // src/gate/diff-shape.ts
 var untrackedLines = (runtime, root, changes) => changes.filter((change) => change.status === "A").reduce((sum, change) => {
-  const text6 = runtime.readText(toAbsolutePath(join13(root, change.path)));
+  const text6 = runtime.readText(toAbsolutePath(join14(root, change.path)));
   return sum + (text6.ok ? text6.value.split("\n").length : 0);
 }, 0);
 var diffShape = (runtime, git, base, changes) => ({
@@ -4676,18 +5070,18 @@ var ciChecks = (value) => Array.isArray(value) ? value.flatMap((item) => {
 var parsePrView = (text6) => {
   const parsed = parseJsonObject(text6);
   if (!parsed.ok) return void 0;
-  const record2 = parsed.value;
-  const number = record2["number"];
+  const record3 = parsed.value;
+  const number = record3["number"];
   if (typeof number !== "number") return void 0;
   return {
     number,
-    url: optionalString(record2, "url") ?? "",
-    state: optionalString(record2, "state") ?? "",
-    mergeable: optionalString(record2, "mergeable") ?? "UNKNOWN",
-    mergeStateStatus: optionalString(record2, "mergeStateStatus") ?? "UNKNOWN",
-    baseRefName: optionalString(record2, "baseRefName") ?? "",
-    headRefOid: optionalString(record2, "headRefOid") ?? "",
-    checks: ciChecks(record2["statusCheckRollup"])
+    url: optionalString(record3, "url") ?? "",
+    state: optionalString(record3, "state") ?? "",
+    mergeable: optionalString(record3, "mergeable") ?? "UNKNOWN",
+    mergeStateStatus: optionalString(record3, "mergeStateStatus") ?? "UNKNOWN",
+    baseRefName: optionalString(record3, "baseRefName") ?? "",
+    headRefOid: optionalString(record3, "headRefOid") ?? "",
+    checks: ciChecks(record3["statusCheckRollup"])
   };
 };
 var isConflicting = (pr) => pr.mergeable === "CONFLICTING" || pr.mergeStateStatus === "DIRTY";
@@ -4701,7 +5095,7 @@ var parseMergeTreeConflicts = (stdout) => {
 var PR_FIELDS = "number,url,state,mergeable,mergeStateStatus,baseRefName,headRefOid,statusCheckRollup";
 var PR_CACHE_TTL_MS = 6e4;
 var GH_TIMEOUT_MS = 8e3;
-var gh = (runtime, cwd, args, timeoutMs = GH_TIMEOUT_MS) => runtime.exec({ command: "gh", args, cwd, timeoutMs });
+var gh = (runtime, cwd, args2, timeoutMs = GH_TIMEOUT_MS) => runtime.exec({ command: "gh", args: args2, cwd, timeoutMs });
 var ghAuthenticated = (runtime, cwd, timeoutMs = 4e3) => {
   const result = gh(runtime, cwd, ["auth", "status"], timeoutMs);
   if (result.timedOut) return "timeout";
@@ -4855,10 +5249,10 @@ var applySize = (contract, verdict) => {
 // src/gate/prepare.ts
 var diskFiles = (runtime, root) => ({
   read: (relative9) => {
-    const text6 = runtime.readText(toAbsolutePath(join14(root, relative9)));
+    const text6 = runtime.readText(toAbsolutePath(join15(root, relative9)));
     return text6.ok ? text6.value : void 0;
   },
-  exists: (relative9) => runtime.stat(toAbsolutePath(join14(root, relative9))) !== void 0
+  exists: (relative9) => runtime.stat(toAbsolutePath(join15(root, relative9))) !== void 0
 });
 var baseFiles = (git, base, disk) => ({
   read: (relative9) => base === EMPTY_TREE ? disk.read(relative9) : fileAt(git, base, relative9),
@@ -5120,19 +5514,19 @@ var params = (value) => isRecord(value) ? Object.fromEntries(
 var notes = (value) => Array.isArray(value) ? value.flatMap(
   (item) => isRecord(item) && typeof item["key"] === "string" ? [{ key: item["key"], params: params(item["params"]) }] : []
 ) : [];
-var text3 = (record2, key) => {
-  const value = record2[key];
+var text3 = (record3, key) => {
+  const value = record3[key];
   return typeof value === "string" ? value : void 0;
 };
-var optional = (record2) => {
-  const exitCode = record2["exitCode"];
-  const durationMs = record2["durationMs"];
-  const command = text3(record2, "command");
-  const stdoutSha256 = text3(record2, "stdoutSha256");
-  const releasedBy = text3(record2, "releasedBy");
-  const reason = oneOf2(UNVERIFIED_REASONS, record2["reason"]);
-  const failures = record2["failures"];
-  const testCount = record2["testCount"];
+var optional = (record3) => {
+  const exitCode = record3["exitCode"];
+  const durationMs = record3["durationMs"];
+  const command = text3(record3, "command");
+  const stdoutSha256 = text3(record3, "stdoutSha256");
+  const releasedBy = text3(record3, "releasedBy");
+  const reason = oneOf2(UNVERIFIED_REASONS, record3["reason"]);
+  const failures = record3["failures"];
+  const testCount = record3["testCount"];
   return {
     ...command === void 0 ? {} : { command },
     ...typeof exitCode === "number" || exitCode === null ? { exitCode } : {},
@@ -5147,14 +5541,14 @@ var optional = (record2) => {
 var parseEvidence = (line2) => {
   const parsed = parseJsonObject(line2);
   if (!parsed.ok) return void 0;
-  const record2 = parsed.value;
-  const status = oneOf2(EVIDENCE_STATUSES, record2["status"]);
-  const task = text3(record2, "task");
-  const check2 = text3(record2, "check");
-  const kind = text3(record2, "kind");
-  const treeHash2 = text3(record2, "treeHash");
-  const at = text3(record2, "at");
-  if (record2["schema"] !== EVIDENCE_SCHEMA || status === void 0) return void 0;
+  const record3 = parsed.value;
+  const status = oneOf2(EVIDENCE_STATUSES, record3["status"]);
+  const task = text3(record3, "task");
+  const check2 = text3(record3, "check");
+  const kind = text3(record3, "kind");
+  const treeHash2 = text3(record3, "treeHash");
+  const at = text3(record3, "at");
+  if (record3["schema"] !== EVIDENCE_SCHEMA || status === void 0) return void 0;
   if (task === void 0 || check2 === void 0 || kind === void 0 || treeHash2 === void 0 || at === void 0) {
     return void 0;
   }
@@ -5166,8 +5560,8 @@ var parseEvidence = (line2) => {
     status,
     treeHash: treeHash2,
     at,
-    notes: notes(record2["notes"]),
-    ...optional(record2)
+    notes: notes(record3["notes"]),
+    ...optional(record3)
   };
 };
 var readLedger = (runtime, path) => {
@@ -5706,7 +6100,36 @@ var en_default = {
   "gate.secrets.warning": "warning: {rule} at {file}:{line}",
   "doctor.secrets.remote_credential": "git remote {remotes} has a credential in its URL, stored in plain text in .git/config",
   "doctor.secrets.fix_remote_credential": "run `git remote set-url {remote} <url without user:token@>`, use a credential helper or SSH, and rotate the token",
-  "secrets.session.remote_credential": "git remote {remotes} has a credential in its URL (plain text in .git/config). Ask the person to run `git remote set-url {remote} <url without user:token@>` and rotate the token; do not print the URL."
+  "secrets.session.remote_credential": "git remote {remotes} has a credential in its URL (plain text in .git/config). Ask the person to run `git remote set-url {remote} <url without user:token@>` and rotate the token; do not print the URL.",
+  "gate.require.callers": "no removed or renamed symbol is still called",
+  "gate.callers.none": "{count, plural, one {# removed definition} other {# removed definitions}}, no caller left",
+  "gate.callers.open": "{name} is gone but still called in {count, plural, one {# place} other {# places}}",
+  "gate.callers.at": "{name} called at {file}:{line}",
+  "gate.callers.warning": "warning only: {percent}% of callers findings were released with callers_ignore ({released} of {total}), above the 5% ceiling",
+  "command.policy_false_positive.summary": "Record a false positive of a guard in shadow so it is not promoted",
+  "policy.error.person_only": "Only the person can record a false positive, and this does not look like their terminal (no TTY, or running inside Claude Code)",
+  "policy.false_positive.recorded": "Recorded for {guard}: {count, plural, one {# false positive} other {# false positives}}; it stays in shadow until you set it in .finitemonkey/policy.yml.",
+  "command.app_check.summary": "Start the app or reuse the running one, call one route and check the answer",
+  "app.check.ok": "{url} answered {status}",
+  "app.check.crashed": "the app exited with code {code} before opening the port",
+  "app.check.no_port": "the port of {url} did not open before the timeout",
+  "app.check.no_start": "nothing listens on {url} and no start command was given",
+  "app.check.wrong_status": "{url} answered {status}",
+  "app.check.body_mismatch": "{url} answered {status} without the expected text",
+  "app.check.request_failed": "the request to {url} failed",
+  "app.check.usage": "give --port as a number from 1 to 65535; --status and --timeout must be positive numbers",
+  "gate.require.runtime": "the app starts and `{command}` answers as declared",
+  "gate.runtime.ok": "started, {route} answered {status}, stopped",
+  "gate.runtime.reused": "reused the running app, {route} answered {status}",
+  "gate.runtime.crashed": "the app exited with code {code} before opening its port",
+  "gate.runtime.no_port": "port {port} did not open before the timeout",
+  "gate.runtime.no_start": "nothing listens on port {port} and the check has no `run` to start the app",
+  "gate.runtime.no_port_declared": "the runtime check needs a `port`",
+  "gate.runtime.wrong_status": "{route} answered {status}, expected {expected}",
+  "gate.runtime.body_mismatch": '{route} did not contain "{body}"',
+  "gate.runtime.request_failed": "the request to {route} failed: {detail}",
+  "gate.runtime.orphan": "the app on port {port} could not be stopped",
+  "gate.runtime.probe_failed": "the app check did not report a result: {line}"
 };
 
 // src/i18n/es.json
@@ -6230,7 +6653,36 @@ var es_default = {
   "gate.secrets.warning": "aviso: {rule} en {file}:{line}",
   "doctor.secrets.remote_credential": "el remoto git {remotes} tiene una credencial en la URL, guardada en texto plano en .git/config",
   "doctor.secrets.fix_remote_credential": "ejecuta `git remote set-url {remote} <url sin usuario:token@>`, usa un credential helper o SSH y rota el token",
-  "secrets.session.remote_credential": "el remoto git {remotes} tiene una credencial en la URL (texto plano en .git/config). Pide a la persona que ejecute `git remote set-url {remote} <url sin usuario:token@>` y rote el token; no imprimas la URL."
+  "secrets.session.remote_credential": "el remoto git {remotes} tiene una credencial en la URL (texto plano en .git/config). Pide a la persona que ejecute `git remote set-url {remote} <url sin usuario:token@>` y rote el token; no imprimas la URL.",
+  "gate.require.callers": "ningún símbolo eliminado o renombrado sigue siendo llamado",
+  "gate.callers.none": "{count, plural, one {# definición eliminada} other {# definiciones eliminadas}}, ningún llamador quedó",
+  "gate.callers.open": "{name} ya no existe, pero se llama en {count, plural, one {# lugar} other {# lugares}}",
+  "gate.callers.at": "{name} llamado en {file}:{line}",
+  "gate.callers.warning": "solo aviso: {percent}% de los hallazgos de callers se liberaron con callers_ignore ({released} de {total}), por encima del techo de 5%",
+  "command.policy_false_positive.summary": "Registra un falso positivo de un guard en shadow para que no se promueva",
+  "policy.error.person_only": "Solo la persona puede registrar un falso positivo, y esto no parece su terminal (sin TTY, o dentro de Claude Code)",
+  "policy.false_positive.recorded": "Registrado para {guard}: {count, plural, one {# falso positivo} other {# falsos positivos}}; se queda en shadow hasta que fijes el modo en .finitemonkey/policy.yml.",
+  "command.app_check.summary": "Arranca la app o reutiliza la que ya corre, llama a una ruta y comprueba la respuesta",
+  "app.check.ok": "{url} respondió {status}",
+  "app.check.crashed": "la app salió con código {code} antes de abrir el puerto",
+  "app.check.no_port": "el puerto de {url} no se abrió antes del tiempo límite",
+  "app.check.no_start": "nada escucha en {url} y no se indicó comando de arranque",
+  "app.check.wrong_status": "{url} respondió {status}",
+  "app.check.body_mismatch": "{url} respondió {status} sin el texto esperado",
+  "app.check.request_failed": "la petición a {url} falló",
+  "app.check.usage": "indica --port como número de 1 a 65535; --status y --timeout deben ser números positivos",
+  "gate.require.runtime": "la app arranca y `{command}` responde como se declaró",
+  "gate.runtime.ok": "arrancó, {route} respondió {status}, detenida",
+  "gate.runtime.reused": "reutilizó la app en marcha, {route} respondió {status}",
+  "gate.runtime.crashed": "la app salió con código {code} antes de abrir su puerto",
+  "gate.runtime.no_port": "el puerto {port} no se abrió antes del tiempo límite",
+  "gate.runtime.no_start": "nada escucha en el puerto {port} y la comprobación no tiene `run` para arrancar la app",
+  "gate.runtime.no_port_declared": "la comprobación runtime necesita `port`",
+  "gate.runtime.wrong_status": "{route} respondió {status}, se esperaba {expected}",
+  "gate.runtime.body_mismatch": '{route} no contenía "{body}"',
+  "gate.runtime.request_failed": "la petición a {route} falló: {detail}",
+  "gate.runtime.orphan": "no se pudo detener la app del puerto {port}",
+  "gate.runtime.probe_failed": "la comprobación de la app no devolvió resultado: {line}"
 };
 
 // src/i18n/pt-BR.json
@@ -6754,7 +7206,36 @@ var pt_BR_default = {
   "gate.secrets.warning": "aviso: {rule} em {file}:{line}",
   "doctor.secrets.remote_credential": "o remoto git {remotes} tem uma credencial na URL, guardada em texto puro no .git/config",
   "doctor.secrets.fix_remote_credential": "rode `git remote set-url {remote} <url sem usuario:token@>`, use um credential helper ou SSH e rotacione o token",
-  "secrets.session.remote_credential": "o remoto git {remotes} tem uma credencial na URL (texto puro no .git/config). Peça para a pessoa rodar `git remote set-url {remote} <url sem usuario:token@>` e rotacionar o token; não imprima a URL."
+  "secrets.session.remote_credential": "o remoto git {remotes} tem uma credencial na URL (texto puro no .git/config). Peça para a pessoa rodar `git remote set-url {remote} <url sem usuario:token@>` e rotacionar o token; não imprima a URL.",
+  "gate.require.callers": "nenhum símbolo removido ou renomeado continua sendo chamado",
+  "gate.callers.none": "{count, plural, one {# definição removida} other {# definições removidas}}, nenhum chamador sobrou",
+  "gate.callers.open": "{name} saiu, mas é chamado em {count, plural, one {# lugar} other {# lugares}}",
+  "gate.callers.at": "{name} chamado em {file}:{line}",
+  "gate.callers.warning": "só aviso: {percent}% dos achados de callers foram liberados com callers_ignore ({released} de {total}), acima do teto de 5%",
+  "command.policy_false_positive.summary": "Registra um falso positivo de um guard em shadow para ele não ser promovido",
+  "policy.error.person_only": "Só a pessoa pode registrar um falso positivo, e isto não parece o terminal dela (sem TTY, ou rodando dentro do Claude Code)",
+  "policy.false_positive.recorded": "Registrado para {guard}: {count, plural, one {# falso positivo} other {# falsos positivos}}; ele fica em shadow até você definir o modo em .finitemonkey/policy.yml.",
+  "command.app_check.summary": "Sobe o app ou reaproveita o que está rodando, chama uma rota e confere a resposta",
+  "app.check.ok": "{url} respondeu {status}",
+  "app.check.crashed": "o app saiu com código {code} antes de abrir a porta",
+  "app.check.no_port": "a porta de {url} não abriu antes do tempo limite",
+  "app.check.no_start": "nada escuta em {url} e nenhum comando de início foi dado",
+  "app.check.wrong_status": "{url} respondeu {status}",
+  "app.check.body_mismatch": "{url} respondeu {status} sem o texto esperado",
+  "app.check.request_failed": "a requisição para {url} falhou",
+  "app.check.usage": "passe --port como número de 1 a 65535; --status e --timeout precisam ser números positivos",
+  "gate.require.runtime": "o app sobe e `{command}` responde como declarado",
+  "gate.runtime.ok": "subiu, {route} respondeu {status}, parado",
+  "gate.runtime.reused": "reaproveitou o app rodando, {route} respondeu {status}",
+  "gate.runtime.crashed": "o app saiu com código {code} antes de abrir a porta",
+  "gate.runtime.no_port": "a porta {port} não abriu antes do tempo limite",
+  "gate.runtime.no_start": "nada escuta na porta {port} e a checagem não tem `run` para subir o app",
+  "gate.runtime.no_port_declared": "a checagem runtime precisa de `port`",
+  "gate.runtime.wrong_status": "{route} respondeu {status}, esperado {expected}",
+  "gate.runtime.body_mismatch": '{route} não continha "{body}"',
+  "gate.runtime.request_failed": "a requisição para {route} falhou: {detail}",
+  "gate.runtime.orphan": "o app na porta {port} não pôde ser parado",
+  "gate.runtime.probe_failed": "a checagem do app não devolveu resultado: {line}"
 };
 
 // src/i18n/review.json
@@ -7279,7 +7760,36 @@ var review_default = {
     "gate.secrets.warning": "machine",
     "doctor.secrets.remote_credential": "machine",
     "doctor.secrets.fix_remote_credential": "machine",
-    "secrets.session.remote_credential": "machine"
+    "secrets.session.remote_credential": "machine",
+    "gate.require.callers": "machine",
+    "gate.callers.none": "machine",
+    "gate.callers.open": "machine",
+    "gate.callers.at": "machine",
+    "gate.callers.warning": "machine",
+    "command.policy_false_positive.summary": "machine",
+    "policy.error.person_only": "machine",
+    "policy.false_positive.recorded": "machine",
+    "command.app_check.summary": "machine",
+    "app.check.ok": "machine",
+    "app.check.crashed": "machine",
+    "app.check.no_port": "machine",
+    "app.check.no_start": "machine",
+    "app.check.wrong_status": "machine",
+    "app.check.body_mismatch": "machine",
+    "app.check.request_failed": "machine",
+    "app.check.usage": "machine",
+    "gate.require.runtime": "machine",
+    "gate.runtime.ok": "machine",
+    "gate.runtime.reused": "machine",
+    "gate.runtime.crashed": "machine",
+    "gate.runtime.no_port": "machine",
+    "gate.runtime.no_start": "machine",
+    "gate.runtime.no_port_declared": "machine",
+    "gate.runtime.wrong_status": "machine",
+    "gate.runtime.body_mismatch": "machine",
+    "gate.runtime.request_failed": "machine",
+    "gate.runtime.orphan": "machine",
+    "gate.runtime.probe_failed": "machine"
   },
   es: {
     "command.init.summary": "machine",
@@ -7801,7 +8311,36 @@ var review_default = {
     "gate.secrets.warning": "machine",
     "doctor.secrets.remote_credential": "machine",
     "doctor.secrets.fix_remote_credential": "machine",
-    "secrets.session.remote_credential": "machine"
+    "secrets.session.remote_credential": "machine",
+    "gate.require.callers": "machine",
+    "gate.callers.none": "machine",
+    "gate.callers.open": "machine",
+    "gate.callers.at": "machine",
+    "gate.callers.warning": "machine",
+    "command.policy_false_positive.summary": "machine",
+    "policy.error.person_only": "machine",
+    "policy.false_positive.recorded": "machine",
+    "command.app_check.summary": "machine",
+    "app.check.ok": "machine",
+    "app.check.crashed": "machine",
+    "app.check.no_port": "machine",
+    "app.check.no_start": "machine",
+    "app.check.wrong_status": "machine",
+    "app.check.body_mismatch": "machine",
+    "app.check.request_failed": "machine",
+    "app.check.usage": "machine",
+    "gate.require.runtime": "machine",
+    "gate.runtime.ok": "machine",
+    "gate.runtime.reused": "machine",
+    "gate.runtime.crashed": "machine",
+    "gate.runtime.no_port": "machine",
+    "gate.runtime.no_start": "machine",
+    "gate.runtime.no_port_declared": "machine",
+    "gate.runtime.wrong_status": "machine",
+    "gate.runtime.body_mismatch": "machine",
+    "gate.runtime.request_failed": "machine",
+    "gate.runtime.orphan": "machine",
+    "gate.runtime.probe_failed": "machine"
   }
 };
 
@@ -8080,6 +8619,256 @@ var recordReview = (runtime, paths, treeHash2, agent) => {
   return writeJsonFile(runtime, paths.cache(REVIEWS_FILE), { reviews: reviews.map((review2) => ({ ...review2 })) }).ok;
 };
 
+// src/gate/callers/rate.ts
+var FLAGGED_EVENT = "callers.flagged";
+var RELEASED_EVENT = "callers.released";
+var MIN_SAMPLE = 20;
+var MAX_FALSE_POSITIVE = 0.05;
+var pairs = (record3) => {
+  const { task, names } = record3;
+  if (typeof task !== "string" || !Array.isArray(names)) return [];
+  return names.filter((name) => typeof name === "string").map((name) => `${task}\0${name}`);
+};
+var callersRate = (runtime, paths) => {
+  const text6 = runtime.readText(paths.log);
+  const flagged = /* @__PURE__ */ new Set();
+  const released2 = /* @__PURE__ */ new Set();
+  for (const line2 of text6.ok ? text6.value.split("\n") : []) {
+    const parsed = line2.trim() === "" ? void 0 : parseJsonObject(line2);
+    if (parsed === void 0 || !parsed.ok || !isRecord(parsed.value)) continue;
+    const event = parsed.value["event"];
+    const target = event === FLAGGED_EVENT ? flagged : event === RELEASED_EVENT ? released2 : void 0;
+    if (target !== void 0) for (const pair of pairs(parsed.value)) target.add(pair);
+  }
+  const total = (/* @__PURE__ */ new Set([...flagged, ...released2])).size;
+  const rate = total === 0 ? 0 : released2.size / total;
+  return {
+    flagged: total,
+    released: released2.size,
+    rate,
+    downgraded: total >= MIN_SAMPLE && rate > MAX_FALSE_POSITIVE
+  };
+};
+
+// src/gate/callers/scan.ts
+import { join as join16 } from "node:path";
+
+// src/gate/callers/imports.ts
+import { posix as posix2 } from "node:path";
+var JS_SPECIFIER = /(?:\bfrom\s*|\bimport\s*\(?\s*|\brequire\s*\(\s*)["']([^"']+)["']/g;
+var JS_EXTENSION = /\.(?:[cm]?[jt]sx?)$/;
+var stripModule = (path) => path.replace(JS_EXTENSION, "").replace(/\/index$/, "");
+var jsSpecifiers = (text6) => [...text6.matchAll(JS_SPECIFIER)].map((match) => match[1] ?? "");
+var jsImports = (callerPath, callerText, origin) => {
+  const target = stripModule(origin);
+  return jsSpecifiers(callerText).some((specifier) => {
+    if (specifier.startsWith(".")) {
+      return stripModule(posix2.normalize(posix2.join(posix2.dirname(callerPath), specifier))) === target;
+    }
+    const bare = stripModule(specifier.replace(/^[@~#]\//, ""));
+    return target === bare || target.endsWith(`/${bare}`);
+  });
+};
+var pyImports = (callerText, origin) => {
+  const stem = posix2.basename(origin).replace(/\.py$/, "");
+  const module = stem === "__init__" ? posix2.basename(posix2.dirname(origin)) : stem;
+  const word2 = new RegExp(`\\b${module}\\b`);
+  return callerText.split(/\r?\n/).some((line2) => /^\s*(?:from|import)\s/.test(line2) && word2.test(line2));
+};
+var goImports = (callerPath, callerText, origin) => {
+  const dir = posix2.dirname(origin);
+  if (posix2.dirname(callerPath) === dir) return true;
+  const last = posix2.basename(dir);
+  return new RegExp(`"[^"]*\\b${last}"`).test(callerText);
+};
+var importsOrigin = (language, callerPath, callerText, origins) => origins.some((origin) => {
+  if (callerPath === origin) return true;
+  switch (language.imports) {
+    case "none":
+      return true;
+    case "package":
+      return goImports(callerPath, callerText, origin);
+    case "module":
+      return language.id === "py" ? pyImports(callerText, origin) : jsImports(callerPath, callerText, origin);
+  }
+});
+
+// src/gate/callers/languages.ts
+import { extname } from "node:path";
+var JS_NAME = "[A-Za-z_$][\\w$]*";
+var LANGUAGES2 = [
+  {
+    id: "js",
+    extensions: [".js", ".jsx", ".mjs", ".cjs", ".ts", ".tsx", ".mts", ".cts"],
+    definitions: [
+      new RegExp(`^\\s*(?:export\\s+)?(?:default\\s+)?(?:async\\s+)?function\\s*\\*?\\s*(${JS_NAME})`),
+      new RegExp(`^\\s*(?:export\\s+)?(?:default\\s+)?(?:abstract\\s+)?class\\s+(${JS_NAME})`),
+      new RegExp(`^\\s*export\\s+(?:declare\\s+)?(?:const|let|var|enum|interface|type)\\s+(${JS_NAME})`),
+      new RegExp(
+        `^\\s+(?:public\\s+)?(?:static\\s+)?(?:async\\s+)?(${JS_NAME})\\s*\\([^)]*\\)\\s*(?::[^{=]+)?\\{\\s*$`
+      )
+    ],
+    imports: "module",
+    comment: /^\s*(?:\/\/|\/\*|\*)/
+  },
+  {
+    id: "py",
+    extensions: [".py"],
+    definitions: [/^\s*(?:async\s+)?def\s+([A-Za-z]\w*)/, /^\s*class\s+([A-Za-z]\w*)/],
+    imports: "module",
+    comment: /^\s*#/
+  },
+  {
+    id: "go",
+    extensions: [".go"],
+    definitions: [/^func\s+(?:\([^)]*\)\s*)?([A-Za-z]\w*)/, /^type\s+([A-Za-z]\w*)\s+(?:struct|interface)/],
+    imports: "package",
+    comment: /^\s*\/\//
+  },
+  {
+    id: "rb",
+    extensions: [".rb"],
+    definitions: [/^\s*def\s+(?:self\.)?([A-Za-z]\w*[?!]?)/, /^\s*(?:class|module)\s+([A-Z]\w*)/],
+    imports: "none",
+    comment: /^\s*#/
+  },
+  {
+    id: "rs",
+    extensions: [".rs"],
+    definitions: [
+      /^\s*(?:pub(?:\([^)]*\))?\s+)?(?:async\s+)?fn\s+([A-Za-z]\w*)/,
+      /^\s*(?:pub\s+)?(?:struct|enum|trait)\s+([A-Z]\w*)/
+    ],
+    imports: "none",
+    comment: /^\s*\/\//
+  }
+];
+var KEYWORDS = /* @__PURE__ */ new Set([
+  "if",
+  "for",
+  "while",
+  "switch",
+  "catch",
+  "function",
+  "return",
+  "constructor",
+  "with",
+  "do",
+  "else"
+]);
+var languageOf = (path) => {
+  const extension = extname(path).toLowerCase();
+  return LANGUAGES2.find((language) => language.extensions.includes(extension));
+};
+var definitionsIn = (language, text6) => {
+  const names = /* @__PURE__ */ new Set();
+  for (const line2 of text6.split(/\r?\n/)) {
+    for (const pattern of language.definitions) {
+      const name = pattern.exec(line2)?.[1];
+      if (name !== void 0 && !KEYWORDS.has(name)) names.add(name);
+    }
+  }
+  return names;
+};
+var definesName = (language, line2, name) => language.definitions.some((pattern) => pattern.exec(line2)?.[1] === name);
+
+// src/gate/callers/scan.ts
+var MAX_SYMBOLS = 200;
+var current = (runtime, root, path) => {
+  const text6 = runtime.readText(toAbsolutePath(join16(root, path)));
+  return text6.ok ? text6.value : "";
+};
+var keyOf = (language, name) => `${language.id}\0${name}`;
+var redefinedNames = (runtime, git, changes) => {
+  const keys = /* @__PURE__ */ new Set();
+  for (const change of changes) {
+    const language = languageOf(change.path);
+    if (language === void 0 || change.status === "D") continue;
+    for (const name of definitionsIn(language, current(runtime, git.cwd, change.path))) keys.add(keyOf(language, name));
+  }
+  return keys;
+};
+var removedSymbols = (runtime, git, base, changes) => {
+  const redefined = redefinedNames(runtime, git, changes);
+  const found = /* @__PURE__ */ new Map();
+  for (const change of changes) {
+    const language = languageOf(change.oldPath ?? change.path);
+    if (language === void 0 || change.status === "A") continue;
+    const before = definitionsIn(language, fileAt(git, base, change.oldPath ?? change.path) ?? "");
+    const origins = [change.path, ...change.oldPath === void 0 ? [] : [change.oldPath]];
+    for (const name of before) {
+      const key = keyOf(language, name);
+      if (redefined.has(key)) continue;
+      const prior = found.get(key);
+      found.set(key, { name, language, origins: [...prior?.origins ?? [], ...origins] });
+    }
+  }
+  return [...found.values()].slice(0, MAX_SYMBOLS);
+};
+var parseGrep = (output) => output.split("\n").filter((row) => row !== "").flatMap((row) => {
+  const [file = "", line2 = "", ...rest] = row.split("\0");
+  const number = Number(line2);
+  return file === "" || !Number.isInteger(number) ? [] : [{ file: toPosixPath(file), line: number, text: rest.join("\0") }];
+});
+var grep = (git, names) => {
+  if (names.length === 0) return [];
+  const patterns = names.flatMap((name) => ["-e", name]);
+  return parseGrep(
+    git.out(["grep", "-n", "-z", "-w", "-I", "--untracked", "--no-color", ...patterns, "--", ".", EXCLUDE_FM]) ?? ""
+  );
+};
+var mentions = (text6, name) => new RegExp(`(?<![\\w$])${name.replace(/[$?!]/g, "\\$&")}(?![\\w$])`).test(text6);
+var callSites = (runtime, git, symbols) => {
+  const hits = grep(git, [...new Set(symbols.map((symbol) => symbol.name))]);
+  const texts = /* @__PURE__ */ new Map();
+  const textOf4 = (file) => {
+    const cached2 = texts.get(file) ?? current(runtime, git.cwd, file);
+    texts.set(file, cached2);
+    return cached2;
+  };
+  return symbols.flatMap(
+    (symbol) => hits.filter((hit3) => languageOf(hit3.file)?.id === symbol.language.id && mentions(hit3.text, symbol.name)).filter((hit3) => !symbol.language.comment.test(hit3.text) && !definesName(symbol.language, hit3.text, symbol.name)).filter((hit3) => importsOrigin(symbol.language, hit3.file, textOf4(hit3.file), symbol.origins)).map((hit3) => ({ name: symbol.name, file: hit3.file, line: hit3.line }))
+  );
+};
+
+// src/gate/checks/callers.ts
+var MAX_SITES = 10;
+var byName = (sites) => {
+  const grouped = /* @__PURE__ */ new Map();
+  for (const site of sites) grouped.set(site.name, [...grouped.get(site.name) ?? [], site]);
+  return grouped;
+};
+var siteNotes = (open) => [
+  ...[...open].map(([name, sites]) => note("gate.callers.open", { name, count: sites.length })),
+  ...[...open.values()].flat().slice(0, MAX_SITES).map((site) => note("gate.callers.at", { name: site.name, file: site.file, line: site.line }))
+];
+var record = (ctx, event, names) => {
+  if (names.length > 0) logEvent(ctx.runtime, ctx.paths, event, { task: ctx.contract.id, names: [...names] });
+};
+var callersCheck = (_check, ctx) => {
+  const symbols = removedSymbols(ctx.runtime, ctx.git, ctx.base, ctx.changes);
+  const grouped = byName(callSites(ctx.runtime, ctx.git, symbols));
+  const ignore = new Set(ctx.contract.callersIgnore ?? []);
+  const open = new Map([...grouped].filter(([name]) => !ignore.has(name)));
+  record(
+    ctx,
+    RELEASED_EVENT,
+    [...grouped.keys()].filter((name) => ignore.has(name))
+  );
+  record(ctx, FLAGGED_EVENT, [...open.keys()]);
+  if (open.size === 0) return passed([note("gate.callers.none", { count: symbols.length })]);
+  const rate = callersRate(ctx.runtime, ctx.paths);
+  if (!rate.downgraded) return failed(siteNotes(open));
+  return passed([
+    note("gate.callers.warning", {
+      percent: Math.round(rate.rate * 100),
+      released: rate.released,
+      total: rate.flagged
+    }),
+    ...siteNotes(open)
+  ]);
+};
+
 // src/gate/test-summary.ts
 var ANSI2 = new RegExp(`${String.fromCharCode(27)}\\[[0-9;]*m`, "g");
 var COUNTERS = [
@@ -8276,13 +9065,13 @@ var manualCheck = (check2, ctx) => {
 };
 
 // src/gate/checks/placeholders.ts
-import { join as join15 } from "node:path";
+import { join as join17 } from "node:path";
 var MAX_LISTED2 = 10;
 var SKIP_FILES = /\.(md|mdx|txt|rst|lock|snap|svg|png|jpg|gif|json)$|(^|\/)(CHANGELOG|LICENSE)/i;
 var PLACEHOLDER = /\b(TODO|FIXME|XXX)\b|not implemented|NotImplementedError|unimplemented!|todo!\(|lorem ipsum/i;
 var findPlaceholders = (lines3) => lines3.filter((line2) => !isTestFile(line2.path) && !SKIP_FILES.test(line2.path) && PLACEHOLDER.test(line2.text));
 var untrackedAdded = (ctx) => ctx.changes.filter((change) => change.status === "A" && !SKIP_FILES.test(change.path)).flatMap((change) => {
-  const text6 = ctx.runtime.readText(toAbsolutePath(join15(ctx.paths.root, change.path)));
+  const text6 = ctx.runtime.readText(toAbsolutePath(join17(ctx.paths.root, change.path)));
   return text6.ok ? text6.value.split("\n").map((line2, index) => ({ path: change.path, line: index + 1, text: line2 })) : [];
 });
 var placeholdersCheck = (_check, ctx) => {
@@ -8931,9 +9720,9 @@ var isFlagged = (report2) => report2.spans.length > 0;
 var MARKDOWN = /\.(?:md|markdown|mdx)$/i;
 var RECORD_FILE = /(?:^|\/)(?:CHANGELOG|RELEASE[-_]?NOTES|HISTORY)[^/]*$/i;
 var contextOf = (file) => RECORD_FILE.test(toPosixPath(file)) ? "record" : "docs";
-var listed = (runtime, root, args) => {
-  const result = runtime.git(args, root);
-  if (!result.ok) return reject(`git ${args.join(" ")} failed`);
+var listed = (runtime, root, args2) => {
+  const result = runtime.git(args2, root);
+  if (!result.ok) return reject(`git ${args2.join(" ")} failed`);
   return accept(result.stdout.split("\0").map(toPosixPath));
 };
 var changedMarkdown = (runtime, root) => {
@@ -9013,16 +9802,131 @@ var reviewCheck = (check2, ctx) => {
   return failed([...sizeNotes(ctx), note("gate.review.missing", { check: check2.id })]);
 };
 
+// src/app/parse.ts
+var KINDS2 = [
+  "ok",
+  "crashed",
+  "no_port",
+  "wrong_status",
+  "body_mismatch",
+  "request_failed",
+  "no_start"
+];
+var optionalNumber = (value) => typeof value === "number" ? value : void 0;
+var parseAppCheck = (stdout) => {
+  const envelope = parseJsonObject(stdout.trim());
+  if (!envelope.ok) return void 0;
+  const data = envelope.value["data"];
+  if (!isRecord(data)) return void 0;
+  const kind = KINDS2.find((item) => item === data["kind"]);
+  const { output, reused, stopped, durationMs, exitCode, bodyExcerpt } = data;
+  if (kind === void 0 || typeof output !== "string" || typeof reused !== "boolean" || typeof stopped !== "boolean")
+    return void 0;
+  const status = optionalNumber(data["status"]);
+  return {
+    kind,
+    output,
+    reused,
+    stopped,
+    durationMs: optionalNumber(durationMs) ?? 0,
+    ...status === void 0 ? {} : { status },
+    ...typeof exitCode === "number" || exitCode === null ? { exitCode } : {},
+    ...typeof bodyExcerpt === "string" ? { bodyExcerpt } : {}
+  };
+};
+
+// src/gate/checks/runtime.ts
+var PROBE_MARGIN_MS = 15e3;
+var MIN_REMAINING_MS2 = 5e3;
+var TAIL2 = 160;
+var lastLine = (text6) => {
+  const rows = text6.split(/\r?\n/).filter((row) => row.trim() !== "" && !/^\s*at\s|^Node\.js v\d/.test(row));
+  const line2 = (rows.findLast((row) => /error/i.test(row)) ?? rows.at(-1))?.trim() ?? "";
+  return line2.length > TAIL2 ? `${line2.slice(0, TAIL2)}…` : line2;
+};
+var args = (check2, timeoutS) => [
+  "app",
+  "check",
+  "--json",
+  "--port",
+  String(check2.port ?? 0),
+  "--route",
+  check2.route ?? DEFAULT_ROUTE,
+  "--status",
+  String(check2.status ?? DEFAULT_STATUS),
+  "--timeout",
+  String(timeoutS),
+  ...check2.run === void 0 ? [] : ["--start", check2.run],
+  ...check2.body === void 0 ? [] : ["--body", check2.body]
+];
+var resultNotes = (check2, result, ctx) => {
+  const route = check2.route ?? DEFAULT_ROUTE;
+  const line2 = ctx.mask(lastLine(result.output));
+  const output = line2 === "" ? [] : [note("gate.note.output", { line: line2 })];
+  switch (result.kind) {
+    case "ok":
+      return [note(result.reused ? "gate.runtime.reused" : "gate.runtime.ok", { route, status: result.status ?? 0 })];
+    case "crashed":
+      return [note("gate.runtime.crashed", { code: result.exitCode ?? -1 }), ...output];
+    case "no_port":
+      return [note("gate.runtime.no_port", { port: check2.port ?? 0 }), ...output];
+    case "no_start":
+      return [note("gate.runtime.no_start", { port: check2.port ?? 0 })];
+    case "wrong_status":
+      return [
+        note("gate.runtime.wrong_status", {
+          route,
+          status: result.status ?? 0,
+          expected: check2.status ?? DEFAULT_STATUS
+        })
+      ];
+    case "body_mismatch":
+      return [note("gate.runtime.body_mismatch", { route, body: ctx.mask(check2.body ?? "") })];
+    case "request_failed":
+      return [note("gate.runtime.request_failed", { route, detail: ctx.mask(result.bodyExcerpt ?? "") })];
+  }
+};
+var outcome = (check2, result, ctx) => {
+  const notes2 = [
+    ...resultNotes(check2, result, ctx),
+    ...result.stopped ? [] : [note("gate.runtime.orphan", { port: check2.port ?? 0 })]
+  ];
+  const base = result.kind === "ok" && result.stopped ? passed(notes2) : failed(notes2);
+  return {
+    ...base,
+    ...check2.run === void 0 ? {} : { command: check2.run },
+    exitCode: result.exitCode ?? (result.kind === "ok" ? 0 : null),
+    stdoutSha256: sha256Hex(result.output),
+    durationMs: result.durationMs
+  };
+};
+var runtimeCheck = (check2, ctx) => {
+  if (check2.port === void 0) return failed([note("gate.runtime.no_port_declared")]);
+  if (check2.run !== void 0 && !ctx.trusted)
+    return { ...unverified("untrusted", [note("gate.note.untrusted", { task: ctx.contract.id })]), command: check2.run };
+  const remaining = ctx.deadline - nowMs(ctx.runtime) - PROBE_MARGIN_MS;
+  if (remaining < MIN_REMAINING_MS2) return unverified("budget", [note("gate.note.budget")]);
+  const timeoutS = Math.max(1, Math.min(check2.timeoutS ?? DEFAULT_APP_TIMEOUT_S, Math.floor(remaining / 1e3)));
+  const run4 = ctx.runtime.execSelf(args(check2, timeoutS), ctx.paths.root, timeoutS * 1e3 + PROBE_MARGIN_MS);
+  if (run4.timedOut) return unverified("timeout", [note("gate.note.timeout", { seconds: timeoutS })]);
+  const result = parseAppCheck(run4.stdout);
+  if (result === void 0) {
+    return failed([note("gate.runtime.probe_failed", { line: ctx.mask(lastLine(`${run4.stdout}
+${run4.stderr}`)) })]);
+  }
+  return outcome(check2, result, ctx);
+};
+
 // src/secrets/baseline.ts
-import { join as join16 } from "node:path";
+import { join as join18 } from "node:path";
 var BASELINE_FILE2 = ".finitemonkey/findings/baseline.json";
 var BASELINE_SCHEMA = "finitemonkey/secrets-baseline@1";
 var BASELINE_STATES = ["aceito", "falso-positivo"];
 var EXCEPTION_MAX_DAYS = 90;
 var EMPTY_BASELINE = { schema: BASELINE_SCHEMA, entries: [] };
-var baselinePath = (root) => toAbsolutePath(join16(root, BASELINE_FILE2));
-var text5 = (record2, key) => {
-  const value = record2[key];
+var baselinePath = (root) => toAbsolutePath(join18(root, BASELINE_FILE2));
+var text5 = (record3, key) => {
+  const value = record3[key];
   return typeof value === "string" && value !== "" ? value : void 0;
 };
 var stateOf = (value) => BASELINE_STATES.find((state) => state === value);
@@ -9080,22 +9984,22 @@ var withoutFixed = (baseline, fixed) => {
 var acceptedFingerprints = (baseline, now) => new Set(baseline.entries.filter((entry2) => entry2.expiresAt >= now).map((entry2) => entry2.fingerprint));
 
 // src/secrets/incidents.ts
-import { join as join17 } from "node:path";
+import { join as join19 } from "node:path";
 var INCIDENTS_DIR = ".finitemonkey/incidents";
 var INCIDENT_STATES = ["aberto", "exposicao-local", "rotacionado", "fechado"];
 var INCIDENT_SOURCES = ["tool-output", "prompt", "history", "scan"];
 var ID = /^inc-[0-9a-f]{12}$/;
 var incidentId = (rule, fingerprint) => `inc-${sha256Hex(`${rule}\0${fingerprint}`).slice(0, 12)}`;
-var incidentsDir = (root) => toAbsolutePath(join17(root, INCIDENTS_DIR));
-var incidentFile = (root, id) => toAbsolutePath(join17(incidentsDir(root), `${id}.json`));
-var pick2 = (options, value) => options.find((option) => option === value);
-var str2 = (record2, key) => {
-  const value = record2[key];
+var incidentsDir = (root) => toAbsolutePath(join19(root, INCIDENTS_DIR));
+var incidentFile = (root, id) => toAbsolutePath(join19(incidentsDir(root), `${id}.json`));
+var pick3 = (options, value) => options.find((option) => option === value);
+var str2 = (record3, key) => {
+  const value = record3[key];
   return typeof value === "string" ? value : void 0;
 };
 var parseEvent = (value) => {
   if (!isRecord(value)) return void 0;
-  const state = pick2(INCIDENT_STATES, value["state"]);
+  const state = pick3(INCIDENT_STATES, value["state"]);
   const at = str2(value, "at");
   const by = str2(value, "by");
   return state === void 0 || at === void 0 || by === void 0 ? void 0 : { state, at, by };
@@ -9108,12 +10012,12 @@ var parseHistory = (value) => {
 var parseIncident = (raw) => {
   const parsed = parseJsonObject(raw);
   if (!parsed.ok) return parsed;
-  const record2 = parsed.value;
-  const [id, rule, where, fingerprint, createdAt, updatedAt] = ["id", "rule", "where", "fingerprint", "createdAt", "updatedAt"].map((key) => str2(record2, key));
-  const state = pick2(INCIDENT_STATES, record2["state"]);
-  const source = pick2(INCIDENT_SOURCES, record2["source"]);
-  const history = parseHistory(record2["history"]);
-  const firstCommit = str2(record2, "firstCommit");
+  const record3 = parsed.value;
+  const [id, rule, where, fingerprint, createdAt, updatedAt] = ["id", "rule", "where", "fingerprint", "createdAt", "updatedAt"].map((key) => str2(record3, key));
+  const state = pick3(INCIDENT_STATES, record3["state"]);
+  const source = pick3(INCIDENT_SOURCES, record3["source"]);
+  const history = parseHistory(record3["history"]);
+  const firstCommit = str2(record3, "firstCommit");
   if (id === void 0 || !ID.test(id) || rule === void 0 || where === void 0) return reject("incomplete");
   if (fingerprint === void 0 || createdAt === void 0 || updatedAt === void 0) return reject("incomplete");
   if (state === void 0 || source === void 0 || history === void 0) return reject("incomplete");
@@ -9142,7 +10046,7 @@ var listIncidents = (runtime, root) => {
   return names.value.filter((name) => name.endsWith(".json")).map((name) => readIncident(runtime, root, name.slice(0, -".json".length))).flatMap((parsed) => parsed.ok ? [parsed.value] : []).sort((a, b) => a.createdAt.localeCompare(b.createdAt));
 };
 var saveIncident = (runtime, root, incident) => {
-  const ignore = runtime.writeText(toAbsolutePath(join17(incidentsDir(root), ".gitignore")), "*\n");
+  const ignore = runtime.writeText(toAbsolutePath(join19(incidentsDir(root), ".gitignore")), "*\n");
   if (!ignore.ok) return ignore;
   return runtime.writeText(incidentFile(root, incident.id), `${JSON.stringify(incident, null, 2)}
 `);
@@ -9189,7 +10093,7 @@ var moveIncident = (incident, to, now, by) => ({
 var isRotated = (incident) => incident.state === "rotacionado" || incident.state === "fechado";
 
 // src/secrets/scan.ts
-import { join as join18, relative as relative4 } from "node:path";
+import { join as join20, relative as relative4 } from "node:path";
 
 // src/secrets/located.ts
 var findingId = (ruleId, file, fingerprint) => `fm-${sha256Hex(`${ruleId}\0${file}\0${fingerprint}`).slice(0, 16)}`;
@@ -9289,7 +10193,7 @@ var listed2 = (runtime, root, target) => {
   const base = toAbsolutePath(target, root);
   const walked = runtime.walkFiles(base);
   if (!walked.ok) return walked;
-  return accept(walked.value.map((name) => toPosixPath(relative4(root, join18(base, toPosixPath(name))))));
+  return accept(walked.value.map((name) => toPosixPath(relative4(root, join20(base, toPosixPath(name))))));
 };
 var scanFile = (runtime, root, file) => {
   const text6 = runtime.readText(toAbsolutePath(file, root));
@@ -9307,15 +10211,15 @@ var diffFindings = (diff) => {
   return scanner.end().filter((finding3) => !SKIPPED.test(finding3.file));
 };
 var scanStaged = (runtime, root, includeUnstaged = false) => {
-  const args = includeUnstaged ? ["diff", "HEAD", ...DIFF_FLAGS] : ["diff", "--cached", ...DIFF_FLAGS];
-  const git = runtime.git(args, root);
+  const args2 = includeUnstaged ? ["diff", "HEAD", ...DIFF_FLAGS] : ["diff", "--cached", ...DIFF_FLAGS];
+  const git = runtime.git(args2, root);
   if (!git.ok) return reject(git.found ? "git diff failed" : "git not found");
   return accept(diffFindings(git.stdout));
 };
 var scanHistory = async (runtime, root) => {
   const scanner = diffScanner();
-  const args = ["log", "-p", "--all", "--format=commit %H", ...DIFF_FLAGS];
-  const git = await runtime.gitLines(args, root, scanner.push);
+  const args2 = ["log", "-p", "--all", "--format=commit %H", ...DIFF_FLAGS];
+  const git = await runtime.gitLines(args2, root, scanner.push);
   if (!git.ok) return reject(git.found ? "git log failed" : "git not found");
   return accept(scanner.end().filter((finding3) => !SKIPPED.test(finding3.file)));
 };
@@ -9331,11 +10235,11 @@ var secretsGateStatus = (runtime, root, since) => {
   if (!changed.ok) return changed;
   const baseline = loadBaseline(runtime, root);
   if (!baseline.ok) return baseline;
-  const outcome = ratchet([...changed.value, ...untracked2(runtime, root)], baseline.value, runtime.now(), void 0);
+  const outcome2 = ratchet([...changed.value, ...untracked2(runtime, root)], baseline.value, runtime.now(), void 0);
   const openIncidents = listIncidents(runtime, root).filter(
     (incident) => incident.createdAt >= since && incident.state !== "rotacionado" && incident.state !== "fechado"
   );
-  return accept({ findings: [...outcome.fresh, ...outcome.expired], openIncidents });
+  return accept({ findings: [...outcome2.fresh, ...outcome2.expired], openIncidents });
 };
 
 // src/gate/checks/secrets.ts
@@ -9359,7 +10263,7 @@ var secretsCheck = (_check, ctx) => {
 };
 
 // src/gate/checks/tests.ts
-import { join as join19 } from "node:path";
+import { join as join21 } from "node:path";
 
 // src/guards/tests/tree.ts
 var outOfScope = (input, change) => input.testsProtected && input.scopePaths.length > 0 && change.status !== "A" && isTestFile(change.path) && !matchesAny(change.path, input.scopePaths) ? [{ kind: "out_of_scope", path: change.path }] : [];
@@ -9391,7 +10295,7 @@ var treeViolations = (ctx) => {
     changes: relevant,
     before: (path) => fileAt(ctx.git, ctx.base, path),
     after: (path) => {
-      const text6 = ctx.runtime.readText(toAbsolutePath(join19(ctx.paths.root, path)));
+      const text6 = ctx.runtime.readText(toAbsolutePath(join21(ctx.paths.root, path)));
       return text6.ok ? text6.value : void 0;
     },
     acceptedConfigs: ctx.trust.configs,
@@ -9407,12 +10311,12 @@ var testsCheck = (check2, ctx) => {
   const released2 = grant === void 0 ? {} : { releasedBy: `person@${grant.grantedAt}` };
   const releaseNotes = grant === void 0 ? [] : [...notes2, note("gate.note.released", { guard: "tests", reason: grant.reason })];
   if (check2.run === void 0) return { ...passed([note("gate.tests.clean"), ...releaseNotes]), ...released2 };
-  const outcome = runShellCheck(check2, check2.run, ctx);
-  return { ...outcome, notes: [...outcome.notes, ...releaseNotes], ...released2 };
+  const outcome2 = runShellCheck(check2, check2.run, ctx);
+  return { ...outcome2, notes: [...outcome2.notes, ...releaseNotes], ...released2 };
 };
 
 // src/git/tree.ts
-import { join as join20 } from "node:path";
+import { join as join22 } from "node:path";
 
 // src/secrets/guards/paths.ts
 var SAFE_ENV = /^\.env\.(?:example|sample|template|dist|defaults|schema)$/i;
@@ -9434,13 +10338,13 @@ var IDENTITY_ENV = {
   GIT_COMMITTER_EMAIL: "finitemonkey@localhost"
 };
 var failure = (step3, result) => result.timedOut ? `${step3}: timed out` : `${step3}: ${result.stderr.trim() || "git failed"}`;
-var run = (runtime, repo, args, env, options, input) => {
-  const result = runtime.gitWith(args, repo.root, {
+var run = (runtime, repo, args2, env, options, input) => {
+  const result = runtime.gitWith(args2, repo.root, {
     env,
     timeoutMs: options.timeoutMs,
     ...input === void 0 ? {} : { input }
   });
-  return result.ok ? accept(result.stdout.trim()) : reject(failure(args[0] ?? "git", result));
+  return result.ok ? accept(result.stdout.trim()) : reject(failure(args2[0] ?? "git", result));
 };
 var dropSensitive = (runtime, repo, env, options) => {
   const listed4 = run(runtime, repo, ["ls-files", "-z"], env, options);
@@ -9451,7 +10355,7 @@ var dropSensitive = (runtime, repo, env, options) => {
   return removed.ok ? accept(void 0) : removed;
 };
 var withTempIndex = (runtime, repo, options, work) => {
-  const path = toAbsolutePath(join20(repo.gitDir, `finitemonkey-${options.stamp}.index`));
+  const path = toAbsolutePath(join22(repo.gitDir, `finitemonkey-${options.stamp}.index`));
   const env = { GIT_INDEX_FILE: path, GIT_OPTIONAL_LOCKS: "0" };
   try {
     return work(env);
@@ -9503,7 +10407,7 @@ var flushHunk = (draft) => {
   if (draft.current !== void 0) draft.hunks.push(draft.current);
   draft.current = void 0;
 };
-var finish = (draft, out) => {
+var finish2 = (draft, out) => {
   if (draft === void 0) return;
   flushHunk(draft);
   out.push({
@@ -9563,7 +10467,7 @@ var parseUnifiedDiff = (text6) => {
     const line2 = withoutCarriageReturn(raw);
     const start = DIFF_GIT.exec(line2);
     if (start !== null) {
-      finish(draft, out);
+      finish2(draft, out);
       draft = {
         oldPath: start[1],
         newPath: start[2],
@@ -9574,7 +10478,7 @@ var parseUnifiedDiff = (text6) => {
       };
     } else if (draft !== void 0) bodyLine(draft, line2);
   }
-  finish(draft, out);
+  finish2(draft, out);
   return out;
 };
 var DIFF_ARGS = [
@@ -9684,26 +10588,26 @@ var entryOf2 = (kind, xy, path) => ({
   staged: kind !== "untracked" && !xy.startsWith("."),
   unstaged: kind === "untracked" || xy.charAt(1) !== "."
 });
-var afterFields = (record2, count4) => record2.split(" ").slice(count4).join(" ");
+var afterFields = (record3, count4) => record3.split(" ").slice(count4).join(" ");
 var parsePorcelainV2 = (stdout) => {
   const records = stdout.split("\0");
   const out = [];
   for (let index = 0; index < records.length; index += 1) {
-    const record2 = records[index] ?? "";
-    const xy = record2.split(" ")[1] ?? "..";
-    if (record2.startsWith("1 ")) out.push(entryOf2("changed", xy, afterFields(record2, PORCELAIN_FIELDS.ordinary)));
-    else if (record2.startsWith("2 ")) {
-      out.push(entryOf2("changed", xy, afterFields(record2, PORCELAIN_FIELDS.renamed)));
+    const record3 = records[index] ?? "";
+    const xy = record3.split(" ")[1] ?? "..";
+    if (record3.startsWith("1 ")) out.push(entryOf2("changed", xy, afterFields(record3, PORCELAIN_FIELDS.ordinary)));
+    else if (record3.startsWith("2 ")) {
+      out.push(entryOf2("changed", xy, afterFields(record3, PORCELAIN_FIELDS.renamed)));
       index += 1;
-    } else if (record2.startsWith("u ")) {
-      out.push(entryOf2("unmerged", xy, afterFields(record2, PORCELAIN_FIELDS.unmerged)));
-    } else if (record2.startsWith("? ")) out.push(entryOf2("untracked", "??", record2.slice(2)));
+    } else if (record3.startsWith("u ")) {
+      out.push(entryOf2("unmerged", xy, afterFields(record3, PORCELAIN_FIELDS.unmerged)));
+    } else if (record3.startsWith("? ")) out.push(entryOf2("untracked", "??", record3.slice(2)));
   }
   return out.filter((entry2) => entry2.path !== "" && !entry2.path.startsWith(STATE_PREFIX));
 };
 
 // src/git/merge/dropped.ts
-import { join as join21 } from "node:path";
+import { join as join23 } from "node:path";
 
 // src/git/merge/lines.ts
 var normalizeLine = (line2) => line2.replace(/\r$/, "").trim().replace(/\s*,$/, "");
@@ -9783,7 +10687,7 @@ var parseDropped = (text6) => {
   return accept({ items, invalid });
 };
 var loadDropped = (runtime, root, file) => {
-  const path = toAbsolutePath(file ?? join21(root, DROPPED_FILE), root);
+  const path = toAbsolutePath(file ?? join23(root, DROPPED_FILE), root);
   const text6 = runtime.readText(path);
   if (!text6.ok) return file === void 0 ? accept({ items: [], invalid: [] }) : reject(`${file}: ${text6.error}`);
   return parseDropped(text6.value);
@@ -9793,7 +10697,7 @@ var isDropped = (finding3, items) => items.some(
 );
 
 // src/git/merge/generated.ts
-import { join as join22 } from "node:path";
+import { join as join24 } from "node:path";
 var LOCKFILES3 = /* @__PURE__ */ new Set([
   "package-lock.json",
   "npm-shrinkwrap.json",
@@ -9856,7 +10760,7 @@ var verifyGenerated = (runtime, repo, inputs, paths, generators) => {
   if (declared.length === 0) return accept([]);
   const commit2 = resultCommit(runtime, repo, inputs);
   if (!commit2.ok) return commit2;
-  const dir = join22(repo.gitDir, `finitemonkey-generate-${runtime.now().replace(/[:.]/g, "-")}`);
+  const dir = join24(repo.gitDir, `finitemonkey-generate-${runtime.now().replace(/[:.]/g, "-")}`);
   if (!runtime.git(["worktree", "add", "--detach", dir, commit2.value], repo.root).ok)
     return reject("could not check out the merge result");
   try {
@@ -9866,7 +10770,7 @@ var verifyGenerated = (runtime, repo, inputs, paths, generators) => {
     }
     return accept(
       declared.flatMap(({ path }) => {
-        const fresh3 = runtime.readText(toAbsolutePath(join22(dir, path)));
+        const fresh3 = runtime.readText(toAbsolutePath(join24(dir, path)));
         const merged = blobText(runtime, repo, commit2.value, path);
         if (fresh3.ok && fresh3.value === merged) return [];
         return [{ kind: "generated-differs", file: path, side: void 0, line: void 0, text: path, weak: false }];
@@ -10080,16 +10984,16 @@ var failed2 = (error, inputs) => ({
   generated: [],
   error
 });
-var keyOf = (diff) => (diff.status === "added" || diff.status === "copied" ? diff.newPath : diff.oldPath ?? diff.newPath) ?? "";
+var keyOf2 = (diff) => (diff.status === "added" || diff.status === "copied" ? diff.newPath : diff.oldPath ?? diff.newPath) ?? "";
 var pairsOf = (ours, theirs) => {
-  const keys = [...new Set([...ours, ...theirs].map(keyOf))].filter((key) => key !== "").sort();
+  const keys = [...new Set([...ours, ...theirs].map(keyOf2))].filter((key) => key !== "").sort();
   return keys.map((key) => ({
     key,
-    ours: ours.find((diff) => keyOf(diff) === key),
-    theirs: theirs.find((diff) => keyOf(diff) === key)
+    ours: ours.find((diff) => keyOf2(diff) === key),
+    theirs: theirs.find((diff) => keyOf2(diff) === key)
   }));
 };
-var contextOf2 = (runtime, repo, inputs, pairs) => {
+var contextOf2 = (runtime, repo, inputs, pairs2) => {
   const resultText = memoBy((path) => blobText(runtime, repo, inputs.result, path));
   const context = {
     runtime,
@@ -10097,7 +11001,7 @@ var contextOf2 = (runtime, repo, inputs, pairs) => {
     inputs,
     resultText,
     resultFiles: memo2(
-      () => pairs.flatMap((pair) => {
+      () => pairs2.flatMap((pair) => {
         const path = resultPathOf(context, pair);
         return path === void 0 ? [] : [path];
       })
@@ -10114,24 +11018,24 @@ var verifyMerge = (runtime, repo, options = {}) => {
   const theirs = sideDiff(runtime, repo, inputs.value.base, inputs.value.theirs);
   if (!ours.ok) return failed2(ours.error, inputs.value);
   if (!theirs.ok) return failed2(theirs.error, inputs.value);
-  const pairs = pairsOf(ours.value, theirs.value);
+  const pairs2 = pairsOf(ours.value, theirs.value);
   const generators = configMap(loadProjectConfig(runtime, repo.root), "merge", "generators");
   const generated = generatedPaths(
     runtime,
     repo,
-    pairs.map((pair) => pair.key),
+    pairs2.map((pair) => pair.key),
     generators
   );
   const context = contextOf2(
     runtime,
     repo,
     inputs.value,
-    pairs.filter((pair) => !generated.has(pair.key))
+    pairs2.filter((pair) => !generated.has(pair.key))
   );
   const regenerated = verifyGenerated(runtime, repo, inputs.value, [...generated], generators);
   if (!regenerated.ok) return failed2(regenerated.error, inputs.value);
   const all = [
-    ...pairs.filter((pair) => !generated.has(pair.key)).flatMap((pair) => verifyFile(context, pair)),
+    ...pairs2.filter((pair) => !generated.has(pair.key)).flatMap((pair) => verifyFile(context, pair)),
     ...regenerated.value
   ];
   const open = [...dropped.value.invalid, ...all.filter((item) => !isDropped(item, dropped.value.items))];
@@ -10143,7 +11047,7 @@ var verifyMerge = (runtime, repo, options = {}) => {
     theirs: inputs.value.theirs,
     result: inputs.value.result,
     bases: inputs.value.bases,
-    files: pairs.length,
+    files: pairs2.length,
     findings: open,
     justified: all.length - (open.length - dropped.value.invalid.length),
     generated: [...generated].sort(),
@@ -10152,19 +11056,19 @@ var verifyMerge = (runtime, repo, options = {}) => {
 };
 
 // src/git/ownership.ts
-import { join as join23 } from "node:path";
+import { join as join25 } from "node:path";
 var OWNERSHIP_DIR = ".finitemonkey/git";
 var ownerKey = (raw) => {
   const cleaned = (raw ?? "").replace(/[^A-Za-z0-9._-]/g, "_").slice(0, 80);
   return cleaned === "" ? "unknown" : cleaned;
 };
-var fileOf = (repo, kind, owner) => toAbsolutePath(join23(repo.root, OWNERSHIP_DIR, kind, `${ownerKey(owner)}.json`));
+var fileOf = (repo, kind, owner) => toAbsolutePath(join25(repo.root, OWNERSHIP_DIR, kind, `${ownerKey(owner)}.json`));
 var readDirty = (runtime, root) => {
   const status = runtime.git(["status", "--porcelain=v2", "-z", "--untracked-files=all"], root);
   return status.ok ? parsePorcelainV2(status.stdout) : void 0;
 };
 var hashDirty = (runtime, repo, entries) => {
-  const present2 = entries.filter((entry2) => runtime.stat(toAbsolutePath(join23(repo.root, entry2.path)))?.kind === "file");
+  const present2 = entries.filter((entry2) => runtime.stat(toAbsolutePath(join25(repo.root, entry2.path)))?.kind === "file");
   const hashed = present2.length === 0 ? void 0 : runtime.gitWith(["hash-object", "--stdin-paths"], repo.root, {
     input: `${present2.map((entry2) => entry2.path).join("\n")}
 `
@@ -10291,8 +11195,8 @@ var openRepo = (runtime, dir) => {
 };
 var globRegex2 = (pattern) => new RegExp(`^${pattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*")}$`);
 var matchesBranch = (branch, patterns) => patterns.some((pattern) => globRegex2(pattern).test(branch));
-var line = (runtime, root, args) => {
-  const result = runtime.git(args, root);
+var line = (runtime, root, args2) => {
+  const result = runtime.git(args2, root);
   const value = result.stdout.trim();
   return result.ok && value !== "" ? value : void 0;
 };
@@ -10417,20 +11321,22 @@ var DEFAULT_CHECKS = {
   prose: proseCheck,
   worktree: worktreeCheck,
   merge: mergeCheck,
-  review: reviewCheck
+  review: reviewCheck,
+  callers: callersCheck,
+  runtime: runtimeCheck
 };
 
 // src/gate/run.ts
 var FAST_PATH_MS = 10 * 6e4;
-var toEvidence = (ctx, check2, outcome) => ({
+var toEvidence = (ctx, check2, outcome2) => ({
   schema: EVIDENCE_SCHEMA,
   task: ctx.contract.id,
   check: check2.id,
   kind: check2.kind,
   treeHash: ctx.treeHash,
   at: ctx.runtime.now(),
-  ...outcome,
-  ...check2.run === void 0 || outcome.command !== void 0 ? {} : { command: check2.run }
+  ...outcome2,
+  ...check2.run === void 0 || outcome2.command !== void 0 ? {} : { command: check2.run }
 });
 var reusable = (ledger, ctx, check2) => {
   if (!REUSABLE_KINDS.includes(check2.kind)) return false;
@@ -10611,7 +11517,7 @@ var subagentStopGate = (input) => {
 };
 
 // src/gate/hooks/subagent.ts
-import { join as join24 } from "node:path";
+import { join as join26 } from "node:path";
 var NO_CONTRACT_AGENTS = /(^|:)(reviewer|verifier|explore|plan|claude-code-guide|statusline-setup)$/i;
 var KNOWN_KINDS = /* @__PURE__ */ new Set([
   "command",
@@ -10625,7 +11531,9 @@ var KNOWN_KINDS = /* @__PURE__ */ new Set([
   "prose",
   "worktree",
   "merge",
-  "review"
+  "review",
+  "callers",
+  "runtime"
 ]);
 var requirementText = (t, check2) => {
   const key = `gate.require.${check2.kind}`;
@@ -10646,12 +11554,12 @@ var subagentStart = (input) => {
   const active = readState(runtime, paths).active;
   if (active === void 0) return { kind: "allow" };
   const disk = (relative9) => {
-    const text6 = runtime.readText(toAbsolutePath(join24(paths.root, relative9)));
+    const text6 = runtime.readText(toAbsolutePath(join26(paths.root, relative9)));
     return text6.ok ? text6.value : void 0;
   };
   const loaded = loadTask(runtime, paths, { disk, base: () => void 0 }, active);
   if (!loaded.ok) return { kind: "allow" };
-  const briefing = runtime.stat(toAbsolutePath(join24(paths.dir, "briefing.md"))) !== void 0;
+  const briefing = runtime.stat(toAbsolutePath(join26(paths.dir, "briefing.md"))) !== void 0;
   return { kind: "allow", output: contextOutput("SubagentStart", contractFacts(t, loaded.value.contract, briefing)) };
 };
 
@@ -10668,7 +11576,7 @@ var PORTAO_HANDLERS = {
 };
 
 // src/prod/guard.ts
-import { join as join26 } from "node:path";
+import { join as join28 } from "node:path";
 
 // src/git/command-text.ts
 var MAX_SHOWN = 160;
@@ -10818,10 +11726,10 @@ var HELM_READ = /* @__PURE__ */ new Set([
   "env"
 ]);
 var CURL_WRITE = /^(?:-X|--request|-d|--data.*|-F|--form|-T|--upload-file|-o|--output|-O|--remote-name)$/;
-var firstPositional = (args, valueFlags = /* @__PURE__ */ new Set()) => {
+var firstPositional = (args2, valueFlags = /* @__PURE__ */ new Set()) => {
   const out = [];
-  for (let index = 0; index < args.length; index += 1) {
-    const arg = args[index] ?? "";
+  for (let index = 0; index < args2.length; index += 1) {
+    const arg = args2[index] ?? "";
     if (arg.startsWith("-")) {
       if (valueFlags.has(arg)) index += 1;
     } else out.push(arg);
@@ -10856,16 +11764,16 @@ var KUBE_VALUE_FLAGS = /* @__PURE__ */ new Set([
   "--container",
   "--kube-context"
 ]);
-var dockerReadOnly = (args) => {
-  const words = firstPositional(args, DOCKER_VALUE_FLAGS);
+var dockerReadOnly = (args2) => {
+  const words = firstPositional(args2, DOCKER_VALUE_FLAGS);
   const [first, second] = words;
   if (first === void 0) return true;
   if (DOCKER_GROUPS.has(first))
     return second === void 0 || DOCKER_READ.has(second) || first === "compose" && second === "top";
   return DOCKER_READ.has(first);
 };
-var kubectlReadOnly = (program, args) => {
-  const [verb, object] = firstPositional(args, KUBE_VALUE_FLAGS);
+var kubectlReadOnly = (program, args2) => {
+  const [verb, object] = firstPositional(args2, KUBE_VALUE_FLAGS);
   if (verb === void 0) return true;
   if (program === "helm") return HELM_READ.has(verb);
   if (verb === "config") return object === "view" || object === "get-contexts" || object === "current-context";
@@ -10875,24 +11783,24 @@ var kubectlReadOnly = (program, args) => {
 var writesFile = (command) => command.redirects.some(
   (redirect) => (redirect.op === ">" || redirect.op === ">>" || redirect.op === ">|") && !/^(?:\/dev\/null|&?\d)$/.test(redirect.target) && !redirect.op.startsWith("<")
 );
-var gitReadOnly = (args) => {
-  const [verb, ...rest] = firstPositional(args, /* @__PURE__ */ new Set(["-C", "-c"]));
+var gitReadOnly = (args2) => {
+  const [verb, ...rest] = firstPositional(args2, /* @__PURE__ */ new Set(["-C", "-c"]));
   if (verb === void 0) return true;
   if (GIT_READ.has(verb)) return true;
   return GIT_LIST.has(verb) && (rest.length === 0 || verb === "stash" && rest[0] === "list");
 };
 var programReadOnly = (command) => {
-  const { program, args } = command;
-  if (program === "git") return gitReadOnly(args);
+  const { program, args: args2 } = command;
+  if (program === "git") return gitReadOnly(args2);
   if (program === "docker" || program === "docker-compose")
-    return dockerReadOnly(program === "docker-compose" ? ["compose", ...args] : args);
-  if (program === "systemctl") return SYSTEMCTL_READ.has(firstPositional(args)[0] ?? "status");
-  if (program === "kubectl" || program === "helm") return kubectlReadOnly(program, args);
-  if (program === "curl") return !args.some((arg) => CURL_WRITE.test(arg));
+    return dockerReadOnly(program === "docker-compose" ? ["compose", ...args2] : args2);
+  if (program === "systemctl") return SYSTEMCTL_READ.has(firstPositional(args2)[0] ?? "status");
+  if (program === "kubectl" || program === "helm") return kubectlReadOnly(program, args2);
+  if (program === "curl") return !args2.some((arg) => CURL_WRITE.test(arg));
   if (program === "find")
-    return !args.some((arg) => arg === "-delete" || arg.startsWith("-exec") || arg.startsWith("-ok"));
-  if (program === "sed") return !args.some((arg) => arg.startsWith("-i") || arg === "--in-place");
-  if (program === "awk") return !args.some((arg) => arg.includes("system(") || arg.includes(">"));
+    return !args2.some((arg) => arg === "-delete" || arg.startsWith("-exec") || arg.startsWith("-ok"));
+  if (program === "sed") return !args2.some((arg) => arg.startsWith("-i") || arg === "--in-place");
+  if (program === "awk") return !args2.some((arg) => arg.includes("system(") || arg.includes(">"));
   return READ_PROGRAMS.has(program);
 };
 var readOnlyCommand = (command) => !writesFile(command) && programReadOnly(command);
@@ -10952,11 +11860,11 @@ var RSYNC_LONG_VALUE = /* @__PURE__ */ new Set([
   "--files-from"
 ]);
 var parseSsh = (command) => {
-  const { args } = command;
+  const { args: args2 } = command;
   let index = 0;
   let noCommand = false;
-  while (index < args.length && (args[index] ?? "").startsWith("-")) {
-    const arg = args[index] ?? "";
+  while (index < args2.length && (args2[index] ?? "").startsWith("-")) {
+    const arg = args2[index] ?? "";
     if (arg === "--") {
       index += 1;
       break;
@@ -10965,17 +11873,17 @@ var parseSsh = (command) => {
     const last = arg.charAt(arg.length - 1);
     index += arg.length === 2 && SSH_VALUE.includes(last) ? 2 : 1;
   }
-  const destination = args[index];
+  const destination = args2[index];
   if (destination === void 0) return void 0;
-  return { destination: destination.replace(/^ssh:\/\//, ""), remote: args.slice(index + 1), noCommand };
+  return { destination: destination.replace(/^ssh:\/\//, ""), remote: args2.slice(index + 1), noCommand };
 };
 var REMOTE_PATH = /^(?:(?:scp|rsync|sftp):\/\/)?(?:[^@/:\s]+@)?(\[[^\]]+\]|[A-Za-z0-9][A-Za-z0-9.-]*)(?::|::|\/)/;
 var remoteHostOf = (operand) => {
   if (/^[A-Za-z]:[\\/]/.test(operand) || operand.startsWith("/") || operand.startsWith(".")) return void 0;
-  const url = /^(?:scp|rsync|sftp):\/\//.test(operand);
+  const url2 = /^(?:scp|rsync|sftp):\/\//.test(operand);
   const match = REMOTE_PATH.exec(operand);
   if (match === null) return void 0;
-  if (!url && !operand.slice(match[0].length - 1).startsWith(":")) return void 0;
+  if (!url2 && !operand.slice(match[0].length - 1).startsWith(":")) return void 0;
   return (match[1] ?? "").replace(/^\[|\]$/g, "");
 };
 var copyOperands = (command, shortValue) => {
@@ -11010,7 +11918,7 @@ var remoteHostsOf = (command) => {
 };
 
 // src/prod/targets.ts
-import { join as join25 } from "node:path";
+import { join as join27 } from "node:path";
 var DEPLOY_FILES = [
   "deploy.sh",
   "scripts/deploy.sh",
@@ -11034,12 +11942,12 @@ var hostsInText = (text6) => {
   return [...urls, ...keyed, ...commands].filter((host) => host !== "" && !host.includes("$"));
 };
 var workflowFiles = (runtime, root) => {
-  const listed4 = runtime.listDir(toAbsolutePath(join25(root, ".github", "workflows")));
+  const listed4 = runtime.listDir(toAbsolutePath(join27(root, ".github", "workflows")));
   if (!listed4.ok) return [];
   return listed4.value.filter((name) => /deploy/i.test(name) && /\.ya?ml$/i.test(name)).map((name) => `.github/workflows/${name}`);
 };
 var detectedHosts = (runtime, root, files) => files.flatMap((file) => {
-  const text6 = runtime.readText(toAbsolutePath(join25(root, file)));
+  const text6 = runtime.readText(toAbsolutePath(join27(root, file)));
   return text6.ok ? hostsInText(text6.value) : [];
 });
 var loadProdTargets = (runtime, root, config) => {
@@ -11051,7 +11959,7 @@ var loadProdTargets = (runtime, root, config) => {
     ...detectedHosts(runtime, root, deployFiles)
   ];
   const declaredDeploy = configAt(config, "prod", "deploy");
-  const existing = deployFiles.find((file) => runtime.stat(toAbsolutePath(join25(root, file))) !== void 0);
+  const existing = deployFiles.find((file) => runtime.stat(toAbsolutePath(join27(root, file))) !== void 0);
   return {
     hosts: new Set(hosts.map(hostKey).filter((host) => host !== "")),
     kubeContexts: configList(config, "prod", "kube_contexts"),
@@ -11080,12 +11988,12 @@ var copyHit = (command, isProd) => {
   const source = call.sources.map(remoteHostOf).find((host) => host !== void 0 && isProd(host));
   return source === void 0 ? void 0 : hit2("read", hostKey(source), command.program);
 };
-var valueAfter = (args, ...names) => {
-  for (let index = 0; index < args.length; index += 1) {
-    const arg = args[index] ?? "";
+var valueAfter = (args2, ...names) => {
+  for (let index = 0; index < args2.length; index += 1) {
+    const arg = args2[index] ?? "";
     const equals = names.find((name) => arg.startsWith(`${name}=`));
     if (equals !== void 0) return arg.slice(equals.length + 1);
-    if (names.includes(arg)) return args[index + 1];
+    if (names.includes(arg)) return args2[index + 1];
   }
   return void 0;
 };
@@ -11127,8 +12035,8 @@ var DUMPS = /* @__PURE__ */ new Set(["pg_dump", "mysqldump"]);
 var databaseHost = (command) => {
   const flag2 = valueAfter(command.args, "-h", "--host");
   if (flag2 !== void 0) return flag2;
-  const url = [...command.args, command.env["DATABASE_URL"] ?? ""].map((arg) => URL_HOST.exec(arg)?.[1]).find((host) => host !== void 0);
-  return url ?? command.env["PGHOST"];
+  const url2 = [...command.args, command.env["DATABASE_URL"] ?? ""].map((arg) => URL_HOST.exec(arg)?.[1]).find((host) => host !== void 0);
+  return url2 ?? command.env["PGHOST"];
 };
 var databaseReadOnly = (command) => {
   if (DUMPS.has(command.program)) return true;
@@ -11228,8 +12136,8 @@ var recordEvidence = (runtime, root, owner, reads) => {
     ] : []
   );
   if (lines3.length === 0) return;
-  const path = toAbsolutePath(join26(root, EVIDENCE_FILE));
-  runtime.mkdir(toAbsolutePath(join26(root, ".finitemonkey")));
+  const path = toAbsolutePath(join28(root, EVIDENCE_FILE));
+  runtime.mkdir(toAbsolutePath(join28(root, ".finitemonkey")));
   const before = runtime.readText(path);
   const text6 = before.ok ? before.value : "";
   runtime.writeAtomic(path, `${text6}${text6 === "" || text6.endsWith("\n") ? "" : "\n"}${lines3.join("\n")}
@@ -11302,14 +12210,14 @@ var globalOption = (globals, name, value) => {
 var gitInvocation = (command) => {
   if (command.program !== "git") return void 0;
   const globals = { dirs: [], config: {} };
-  const { args } = command;
+  const { args: args2 } = command;
   let index = 0;
-  while (index < args.length && (args[index] ?? "").startsWith("-")) {
-    const arg = args[index] ?? "";
+  while (index < args2.length && (args2[index] ?? "").startsWith("-")) {
+    const arg = args2[index] ?? "";
     const equals = arg.indexOf("=");
     const name = equals > 2 && arg.startsWith("--") ? arg.slice(0, equals) : arg;
     if (WITH_VALUE.has(name) && equals < 0) {
-      globalOption(globals, name, args[index + 1] ?? "");
+      globalOption(globals, name, args2[index + 1] ?? "");
       index += 2;
     } else {
       if (equals > 0) globalOption(globals, name, arg.slice(equals + 1));
@@ -11319,8 +12227,8 @@ var gitInvocation = (command) => {
   return {
     dirs: globals.dirs,
     config: globals.config,
-    subcommand: args[index] ?? "",
-    args: args.slice(index + 1),
+    subcommand: args2[index] ?? "",
+    args: args2.slice(index + 1),
     command
   };
 };
@@ -11331,7 +12239,7 @@ var withAlias = (invocation, expansion) => ({
 });
 
 // src/git/path-key.ts
-import { posix as posix2 } from "node:path";
+import { posix as posix3 } from "node:path";
 var WSL_MOUNT3 = /^\/mnt\/([a-zA-Z])(\/|$)/;
 var DRIVE = /^([a-zA-Z]):(\/|$)/;
 var pathKey = (path) => {
@@ -11340,7 +12248,7 @@ var pathKey = (path) => {
     (_match, letter, slash) => `${letter}:${slash || "/"}`
   );
   const drive = DRIVE.exec(posixPath);
-  const normalized = posix2.normalize(drive === null ? posixPath : posixPath.slice(2) || "/");
+  const normalized = posix3.normalize(drive === null ? posixPath : posixPath.slice(2) || "/");
   const trimmed = normalized.length > 1 ? normalized.replace(/\/+$/, "") : normalized;
   return drive === null ? trimmed : `${(drive[1] ?? "").toLowerCase()}:${trimmed}`.toLowerCase();
 };
@@ -11356,15 +12264,15 @@ var isRootLike = (path, home) => {
   if (key === "/" || /^[a-z]:\/?$/.test(key)) return true;
   return home !== void 0 && home !== "" && key === pathKey(home);
 };
-var resolveFrom = (base, ...parts) => parts.reduce((current, part2) => {
-  if (part2 === void 0 || part2 === "") return current;
+var resolveFrom = (base, ...parts) => parts.reduce((current2, part2) => {
+  if (part2 === void 0 || part2 === "") return current2;
   const next2 = toPosixPath(part2);
   if (next2.startsWith("/") || DRIVE.test(next2)) return next2;
-  return posix2.join(toPosixPath(current), next2);
+  return posix3.join(toPosixPath(current2), next2);
 }, toPosixPath(base));
 
 // src/git/pathspec.ts
-import { posix as posix3 } from "node:path";
+import { posix as posix4 } from "node:path";
 var MAGIC = /^:(?:\(([^)]*)\)|([!^/]*))(.*)$/s;
 var GLOB = /[*?[]/;
 var specOf = (raw, prefix) => {
@@ -11374,7 +12282,7 @@ var specOf = (raw, prefix) => {
   const rest = magic === null ? posixRaw : magic[3] ?? "";
   const exclude = /(?:^|,)exclude(?:,|$)|[!^]/.test(words);
   const top = /(?:^|,)top(?:,|$)|\//.test(words);
-  const joined = posix3.normalize(top ? rest : posix3.join(prefix === "" ? "." : prefix, rest));
+  const joined = posix4.normalize(top ? rest : posix4.join(prefix === "" ? "." : prefix, rest));
   return { pattern: joined === "./" ? "." : joined.replace(/\/$/, ""), exclude };
 };
 var globRegex3 = (pattern) => {
@@ -11407,7 +12315,7 @@ var discard = (op, scope2, pathspecs = []) => ({
   discard: { scope: scope2, pathspecs }
 });
 var SEVERITY = { pass: 0, snapshot: 1, discard: 2, block: 3 };
-var worst = (verdicts) => verdicts.reduce((current, next2) => SEVERITY[next2.kind] > SEVERITY[current.kind] ? next2 : current, PASS);
+var worst = (verdicts) => verdicts.reduce((current2, next2) => SEVERITY[next2.kind] > SEVERITY[current2.kind] ? next2 : current2, PASS);
 
 // src/git/options.ts
 var canonical = (name, spec2) => {
@@ -11454,14 +12362,14 @@ var shortCluster = (building, arg, next2, spec2) => {
   }
   return 1;
 };
-var parseOptions = (args, spec2) => {
+var parseOptions = (args2, spec2) => {
   const building = { flags: /* @__PURE__ */ new Set(), values: /* @__PURE__ */ new Map(), positionals: [] };
   let index = 0;
-  while (index < args.length) {
-    const arg = args[index] ?? "";
-    const next2 = args[index + 1];
+  while (index < args2.length) {
+    const arg = args2[index] ?? "";
+    const next2 = args2[index + 1];
     if (arg === "--") {
-      return { ...building, paths: args.slice(index + 1), dashdash: true };
+      return { ...building, paths: args2.slice(index + 1), dashdash: true };
     }
     if (arg.startsWith("--")) index += longOption(building, arg, next2, spec2);
     else if (arg.startsWith("-") && arg.length > 1 && !/^-\d+$/.test(arg)) {
@@ -11768,24 +12676,24 @@ var branchName = (ref) => {
   if (ref.startsWith("refs/tags/")) return void 0;
   return ref.replace(/^refs\/heads\//, "");
 };
-var refspecTarget = (refspec, current) => {
+var refspecTarget = (refspec, current2) => {
   const plain = refspec.replace(/^\+/, "");
   const colon = plain.indexOf(":");
   const destination = colon < 0 ? plain : plain.slice(colon + 1);
-  if (destination === "HEAD" || colon < 0 && plain === "HEAD") return current;
+  if (destination === "HEAD" || colon < 0 && plain === "HEAD") return current2;
   if (destination === "" || destination.startsWith("refs/tags/")) return void 0;
   return branchName(destination);
 };
 var pushDestinations = (parsed, facts) => {
   if (hasAny(parsed, "--all", "--branches", "--mirror")) return "all";
   const refspecs = parsed.positionals.slice(1).filter((refspec) => refspec !== ":");
-  const current = facts.currentBranch();
+  const current2 = facts.currentBranch();
   if (refspecs.length === 0) {
-    if (hasAny(parsed, "--tags") || current === void 0) return [];
-    return [facts.upstream(current)?.branch ?? current];
+    if (hasAny(parsed, "--tags") || current2 === void 0) return [];
+    return [facts.upstream(current2)?.branch ?? current2];
   }
   return refspecs.flatMap((refspec) => {
-    const target = refspecTarget(refspec, current);
+    const target = refspecTarget(refspec, current2);
     return target === void 0 ? [] : [target];
   });
 };
@@ -11793,10 +12701,10 @@ var leaseVerdict = (parsed, facts) => {
   const leases = valuesOf(parsed, "--force-with-lease");
   const explicit = leases.length > 0 && leases.every((lease) => /^[^:]+:.+$/.test(lease));
   if (!explicit || !hasAny(parsed, "--force-if-includes")) return block2("force-push", "--force-with-lease");
-  const current = facts.currentBranch();
+  const current2 = facts.currentBranch();
   const leased = leases.map((lease) => branchName(lease.slice(0, lease.indexOf(":"))));
   const destinations = pushDestinations(parsed, facts);
-  const own = current !== void 0 && !facts.isProtected(current) && leased.every((name) => name === current) && destinations !== "all" && destinations.every((name) => name === current);
+  const own = current2 !== void 0 && !facts.isProtected(current2) && leased.every((name) => name === current2) && destinations !== "all" && destinations.every((name) => name === current2);
   return own ? PASS : block2("lease-not-own", leased.join(", "));
 };
 var pushVerdict = (invocation, facts) => {
@@ -11819,8 +12727,8 @@ var LEAVES = /* @__PURE__ */ new Set(["--abort", "--quit", "--skip", "--dry-run"
 var commitVerdict = (invocation, facts) => {
   if (invocation.args.some((arg) => LEAVES.has(arg))) return PASS;
   if (invocation.subcommand === "rebase") return PASS;
-  const current = facts.currentBranch();
-  return current !== void 0 && facts.isProtected(current) ? block2("protected-commit", current) : PASS;
+  const current2 = facts.currentBranch();
+  return current2 !== void 0 && facts.isProtected(current2) ? block2("protected-commit", current2) : PASS;
 };
 var pushVerdict2 = (invocation, facts) => {
   const parsed = parseOptions(invocation.args, PUSH_OPTIONS);
@@ -11899,9 +12807,9 @@ var gitVerdict = (invocation, facts) => {
 
 // src/git/switch-target.ts
 var CREATES = /* @__PURE__ */ new Set(["-c", "-C", "-b", "-B", "--create", "--force-create", "--orphan"]);
-var operands = (args) => {
-  if (args.includes("--")) return void 0;
-  return args.filter((arg) => !arg.startsWith("-"));
+var operands = (args2) => {
+  if (args2.includes("--")) return void 0;
+  return args2.filter((arg) => !arg.startsWith("-"));
 };
 var switchTarget = (invocation, facts) => {
   if (invocation.subcommand !== "switch" && invocation.subcommand !== "checkout") return void 0;
@@ -12041,33 +12949,33 @@ var listWorktrees = (runtime, cwd) => {
 };
 
 // src/git/journal.ts
-import { join as join27 } from "node:path";
+import { join as join29 } from "node:path";
 var JOURNAL_FILE = ".finitemonkey/git-journal.jsonl";
 var JOURNAL_SCHEMA = "finitemonkey/git-journal@1";
-var journalPath = (root) => toAbsolutePath(join27(root, JOURNAL_FILE));
+var journalPath = (root) => toAbsolutePath(join29(root, JOURNAL_FILE));
 var headsOf = (value) => isRecord(value) ? Object.fromEntries(
   Object.entries(value).filter((entry2) => typeof entry2[1] === "string")
 ) : {};
 var parseJournalLine = (line2) => {
   const parsed = parseJsonObject(line2);
   if (!parsed.ok) return void 0;
-  const record2 = parsed.value;
-  const ref = optionalString(record2, "ref");
-  const commit2 = optionalString(record2, "commit");
-  const at = optionalString(record2, "at");
+  const record3 = parsed.value;
+  const ref = optionalString(record3, "ref");
+  const commit2 = optionalString(record3, "commit");
+  const at = optionalString(record3, "at");
   if (ref === void 0 || commit2 === void 0 || at === void 0) return void 0;
   return {
     schema: JOURNAL_SCHEMA,
     at,
-    op: optionalString(record2, "op") ?? "",
+    op: optionalString(record3, "op") ?? "",
     ref,
     commit: commit2,
-    head: optionalString(record2, "head"),
-    branch: optionalString(record2, "branch"),
-    index: optionalString(record2, "index"),
-    owner: optionalString(record2, "owner"),
-    command: optionalString(record2, "command"),
-    heads: headsOf(record2["heads"])
+    head: optionalString(record3, "head"),
+    branch: optionalString(record3, "branch"),
+    index: optionalString(record3, "index"),
+    owner: optionalString(record3, "owner"),
+    command: optionalString(record3, "command"),
+    heads: headsOf(record3["heads"])
   };
 };
 var readJournal = (runtime, root) => {
@@ -12080,7 +12988,7 @@ var readJournal = (runtime, root) => {
 };
 var appendJournal = (runtime, root, entry2) => {
   const path = journalPath(root);
-  const made = runtime.mkdir(toAbsolutePath(join27(root, ".finitemonkey")));
+  const made = runtime.mkdir(toAbsolutePath(join29(root, ".finitemonkey")));
   if (!made.ok) return made;
   const previous = runtime.readText(path);
   const before = previous.ok ? previous.value : "";
@@ -12095,8 +13003,8 @@ var BACKUP_PREFIX = "refs/finitemonkey/backup/";
 var DEFAULT_SNAPSHOT_TIMEOUT_MS = 2500;
 var stampOf = (iso) => iso.replace(/[:.]/g, "-");
 var slug = (op) => op.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 40) || "manual";
-var optionalLine = (runtime, repo, args) => {
-  const result = runtime.git(args, repo.root);
+var optionalLine = (runtime, repo, args2) => {
+  const result = runtime.git(args2, repo.root);
   const value = result.stdout.trim();
   return result.ok && value !== "" ? value : void 0;
 };
@@ -12201,17 +13109,17 @@ var fileList = (items) => {
   return items.length > MAX_FILES2 ? `${head} (+${String(items.length - MAX_FILES2)})` : head;
 };
 var foreignLabel = (t, file) => t(file.reason === "before-session" ? "git.foreign.before" : "git.foreign.other", { path: file.path });
-var outcomeMessage = (t, outcome) => {
-  switch (outcome.kind) {
+var outcomeMessage = (t, outcome2) => {
+  switch (outcome2.kind) {
     case "block":
-      return ruleMessage(t, outcome.rule, outcome.command, outcome.subject);
+      return ruleMessage(t, outcome2.rule, outcome2.command, outcome2.subject);
     case "foreign":
       return t("git.block.foreign", {
-        command: outcome.command,
-        files: fileList(outcome.files.map((file) => foreignLabel(t, file)))
+        command: outcome2.command,
+        files: fileList(outcome2.files.map((file) => foreignLabel(t, file)))
       });
     case "unknown":
-      return t("git.block.unknown", { command: outcome.command });
+      return t("git.block.unknown", { command: outcome2.command });
     case "pass":
     case "snapshot":
       return void 0;
@@ -12255,10 +13163,10 @@ var review = (input, commands, owner) => {
     const decision = PROD_PROGRAMS.has(command.program) ? prod().decide(command) : void 0;
     if (decision?.kind === "block") return { blocked: decision.reason, snapshots, reads };
     if (decision !== void 0) reads.push(decision);
-    for (const outcome of guardGitCommand({ runtime: input.runtime, cwd: input.cwd, owner, chain }, command)) {
-      const message = outcomeMessage(input.t, outcome);
+    for (const outcome2 of guardGitCommand({ runtime: input.runtime, cwd: input.cwd, owner, chain }, command)) {
+      const message = outcomeMessage(input.t, outcome2);
       if (message !== void 0) return { blocked: message, snapshots, reads };
-      if (outcome.kind === "snapshot") snapshots.push(outcome);
+      if (outcome2.kind === "snapshot") snapshots.push(outcome2);
     }
   }
   return { blocked: void 0, snapshots, reads };
@@ -12322,6 +13230,83 @@ var GIT_HANDLERS = {
   PostToolUse: [gitPostToolUse]
 };
 
+// src/policy/guards.ts
+var SHADOW_FILE = "shadow.json";
+var numberOf = (value) => typeof value === "number" && Number.isInteger(value) ? value : 0;
+var readShadow = (runtime, paths) => {
+  const text6 = runtime.readText(paths.cache(SHADOW_FILE));
+  const parsed = text6.ok ? parseJsonObject(text6.value) : void 0;
+  if (parsed?.ok !== true) return {};
+  return Object.fromEntries(
+    Object.entries(parsed.value).flatMap(
+      ([id, value]) => isRecord(value) ? [
+        [
+          id,
+          {
+            firings: numberOf(value["firings"]),
+            falsePositives: numberOf(value["falsePositives"]),
+            promoted: value["promoted"] === true
+          }
+        ]
+      ] : []
+    )
+  );
+};
+var writeShadow = (runtime, paths, state) => {
+  runtime.writeText(paths.cache(SHADOW_FILE), `${JSON.stringify(state, null, 2)}
+`);
+};
+var modeOf2 = (set, policy, shadow) => {
+  if (set.damage) return "active";
+  const chosen = policy.guards[set.id];
+  if (chosen !== void 0) return chosen;
+  if (!policy.exists) return "active";
+  return shadow[set.id]?.promoted === true ? "active" : "shadow";
+};
+var recordShadow = (input, paths, set, policy, reason) => {
+  const { runtime } = input;
+  const state = readShadow(runtime, paths);
+  const before = state[set.id] ?? { firings: 0, falsePositives: 0, promoted: false };
+  const firings = before.firings + 1;
+  const promoted = !before.promoted && firings >= policy.promoteAfter && before.falsePositives === 0;
+  writeShadow(runtime, paths, { ...state, [set.id]: { ...before, firings, promoted: before.promoted || promoted } });
+  logEvent(runtime, paths, "guard_shadow", {
+    guard: set.id,
+    hook: input.event,
+    tool: toolName2(input.payload),
+    wouldHave: "block",
+    reason
+  });
+  if (promoted) {
+    logEvent(runtime, paths, "guard_promoted", {
+      guard: set.id,
+      firings,
+      falsePositives: before.falsePositives,
+      promoteAfter: policy.promoteAfter
+    });
+  }
+};
+var governed = (set, handler) => async (input) => {
+  const paths = projectPaths(input);
+  if (paths === void 0) return handler(input);
+  const policy = loadPolicy(input.runtime, paths.root);
+  const mode = modeOf2(set, policy, readShadow(input.runtime, paths));
+  if (mode === "off") return { kind: "allow" };
+  const decision = await handler(input);
+  if (mode === "active" || decision.kind !== "block") return decision;
+  recordShadow(input, paths, set, policy, decision.reason);
+  return { kind: "allow" };
+};
+var withPolicy = (set) => {
+  if (set.damage) return set.handlers;
+  const wrapped = {};
+  for (const event of HOOK_EVENTS) {
+    const list4 = set.handlers[event];
+    if (list4 !== void 0) wrapped[event] = list4.map((handler) => governed(set, handler));
+  }
+  return wrapped;
+};
+
 // src/prose/marker-guard.ts
 import { relative as relative6 } from "node:path";
 
@@ -12427,7 +13412,7 @@ var addsMarker = (input, tool, inputs, file) => {
       return false;
   }
 };
-var isReadOnly = (program, args) => READ_ONLY.has(program) || program === "git" && GIT_READ_ONLY.has(args[0] ?? "");
+var isReadOnly = (program, args2) => READ_ONLY.has(program) || program === "git" && GIT_READ_ONLY.has(args2[0] ?? "");
 var shellAddsMarker = (command) => markerCount(command) > 0 && shellWords(command).segments.some((segment) => !isReadOnly(segment.program, segment.args));
 var shown2 = (cwd, file) => {
   const rel = toPosixPath(relative6(cwd, file));
@@ -12465,17 +13450,17 @@ var GIT_FLAGS = { title: [], body: ["-m", "--message"], file: ["-F", "--file"] }
 var GH_FLAGS = { title: ["-t", "--title"], body: ["-b", "--body"], file: ["-F", "--body-file"] };
 var GIT_GLOBAL_WITH_VALUE = /* @__PURE__ */ new Set(["-C", "-c", "--git-dir", "--work-tree", "--namespace"]);
 var CLUSTER_WITH_MESSAGE = /^-[a-zA-Z]*m$/;
-var flagValues = (args, spec2) => {
+var flagValues = (args2, spec2) => {
   const known2 = [...spec2.title, ...spec2.body, ...spec2.file];
   const out = [];
-  for (let index = 0; index < args.length; index += 1) {
-    const arg = args[index] ?? "";
+  for (let index = 0; index < args2.length; index += 1) {
+    const arg = args2[index] ?? "";
     const equals = arg.indexOf("=");
     const name = arg.startsWith("--") && equals > 0 ? arg.slice(0, equals) : arg;
     if (name !== arg && known2.includes(name)) {
       out.push({ flag: name, value: arg.slice(equals + 1) });
     } else if (known2.includes(arg) || spec2 === GIT_FLAGS && CLUSTER_WITH_MESSAGE.test(arg)) {
-      out.push({ flag: known2.includes(arg) ? arg : "-m", value: args[index + 1] ?? "" });
+      out.push({ flag: known2.includes(arg) ? arg : "-m", value: args2[index + 1] ?? "" });
       index += 1;
     }
   }
@@ -12489,17 +13474,17 @@ var sourceOf = (value, isFile, segment, heredocs) => {
   const piped = segment.args.map((arg) => heredocIn(arg, heredocs)).find((text6) => text6 !== void 0);
   return { kind: "inline", text: piped ?? "" };
 };
-var collect3 = (target, segment, args, spec2, heredocs) => {
-  const values = flagValues(args, spec2);
+var collect3 = (target, segment, args2, spec2, heredocs) => {
+  const values = flagValues(args2, spec2);
   if (values.length === 0) return void 0;
   const title = values.find((item) => spec2.title.includes(item.flag));
   const bodies = values.filter((item) => !spec2.title.includes(item.flag)).map((item) => sourceOf(item.value, spec2.file.includes(item.flag), segment, heredocs));
   return { target, title: title === void 0 ? void 0 : sourceOf(title.value, false, segment, heredocs), bodies };
 };
-var gitSubcommand = (args) => {
+var gitSubcommand = (args2) => {
   let index = 0;
-  while (index < args.length && (args[index] ?? "").startsWith("-")) {
-    index += GIT_GLOBAL_WITH_VALUE.has(args[index] ?? "") ? 2 : 1;
+  while (index < args2.length && (args2[index] ?? "").startsWith("-")) {
+    index += GIT_GLOBAL_WITH_VALUE.has(args2[index] ?? "") ? 2 : 1;
   }
   return index;
 };
@@ -12631,7 +13616,7 @@ var liveFindings = (input, texts) => {
   const accepted2 = acceptedFingerprints(baseline.ok ? baseline.value : EMPTY_BASELINE, input.runtime.now());
   return texts.flatMap((text6) => scanText(text6, { rules: CREDENTIAL_RULES })).filter((finding3) => !accepted2.has(finding3.fingerprint));
 };
-var record = (input, findings, draft, where) => {
+var record2 = (input, findings, draft, where) => {
   const ids2 = findings.map((finding3) => {
     const saved = recordIncident(
       input.runtime,
@@ -12647,7 +13632,7 @@ var secretsUserPromptSubmit = (input) => {
   const prompt = optionalString(input.payload.raw, "prompt") ?? "";
   const findings = liveFindings(input, [prompt]);
   if (findings.length === 0) return { kind: "allow" };
-  const incident = record(input, findings, { source: "prompt", state: "exposicao-local" }, "prompt");
+  const incident = record2(input, findings, { source: "prompt", state: "exposicao-local" }, "prompt");
   const items = findings.map((finding3) => ({ ruleId: finding3.ruleId, where: lineWhere(input.t, finding3) }));
   return {
     kind: "block",
@@ -12658,7 +13643,7 @@ var secretsPostToolUse = (input) => {
   const findings = liveFindings(input, stringLeaves(input.payload.raw["tool_response"]));
   if (findings.length === 0) return { kind: "allow" };
   const tool = toolName2(input.payload) || "tool";
-  const incident = record(input, findings, { source: "tool-output", state: "aberto" }, `tool-output:${tool}`);
+  const incident = record2(input, findings, { source: "tool-output", state: "aberto" }, `tool-output:${tool}`);
   const items = findings.map((finding3) => ({ ruleId: finding3.ruleId, where: lineWhere(input.t, finding3) }));
   const context = input.t("secrets.post.context", { tool, found: describeFindings(input.t, items), incident });
   return {
@@ -12715,7 +13700,7 @@ var READERS = /* @__PURE__ */ new Set([
 var SECRET_NAME = /(?:KEY|SECRET|TOKEN|PASSWORD|PASSWD|PASS|PWD|CREDENTIAL)/i;
 var PERSON_ONLY = /\b(?:finitemonkey|fm)(?:\.mjs)?\s+secrets\s+(?:accept\b|incident\s+(?:rotated|close)\b)/;
 var LISTS_ENV = /* @__PURE__ */ new Set(["get-childitem", "gci", "dir", "ls"]);
-var onlyFlags = (args) => args.every((arg) => arg.startsWith("-"));
+var onlyFlags = (args2) => args2.every((arg) => arg.startsWith("-"));
 var readTarget = (segment) => {
   const redirected = segment.redirectedFrom.find(isSensitivePath);
   if (redirected !== void 0) return redirected;
@@ -12849,17 +13834,17 @@ var secretsPreToolUse = (input) => {
 // src/secrets/remotes.ts
 var USER_AND_SECRET = /^[a-z][a-z0-9+.-]*:\/\/[^\s/@:]+:[^\s/@]+@/i;
 var USERINFO = /^[a-z][a-z0-9+.-]*:\/\/(?<user>[^\s/@]+)@/i;
-var hasCredential = (url) => {
-  if (USER_AND_SECRET.test(url)) return true;
-  const user = USERINFO.exec(url)?.groups?.["user"];
+var hasCredential = (url2) => {
+  if (USER_AND_SECRET.test(url2)) return true;
+  const user = USERINFO.exec(url2)?.groups?.["user"];
   return user !== void 0 && scanText(user, { rules: CREDENTIAL_RULES }).length > 0;
 };
 var parseRemotes = (output) => {
   const remotes = /* @__PURE__ */ new Map();
   for (const line2 of output.split(/\r?\n/)) {
-    const [name, url] = line2.trim().split(/\s+/);
-    if (name === void 0 || url === void 0 || name === "") continue;
-    remotes.set(name, [...remotes.get(name) ?? [], url]);
+    const [name, url2] = line2.trim().split(/\s+/);
+    if (name === void 0 || url2 === void 0 || name === "") continue;
+    remotes.set(name, [...remotes.get(name) ?? [], url2]);
   }
   return remotes;
 };
@@ -12940,12 +13925,13 @@ var SECRETS_HANDLERS = {
   PostToolUse: [secretsPostToolUse],
   SessionStart: [secretsSessionStart]
 };
-var DEFAULT_HANDLERS = mergeHandlers(
-  SECRETS_HANDLERS,
-  PORTAO_HANDLERS,
-  PROSE_HANDLERS,
-  GIT_HANDLERS
-);
+var GUARD_SETS = [
+  { id: "secrets", damage: true, handlers: SECRETS_HANDLERS },
+  { id: "gate", damage: true, handlers: PORTAO_HANDLERS },
+  { id: "prose", damage: false, handlers: PROSE_HANDLERS },
+  { id: "git", damage: true, handlers: GIT_HANDLERS }
+];
+var DEFAULT_HANDLERS = mergeHandlers(...GUARD_SETS.map(withPolicy));
 
 // src/hooks/payload.ts
 var EMPTY_PAYLOAD = {
@@ -13107,9 +14093,9 @@ var invocationOf = (entry2, vars) => {
   const seconds = typeof timeout === "number" && timeout > 0 ? timeout : DEFAULT_TIMEOUT_S;
   const timeoutMs = Math.min(seconds * 1e3, PROBE_TIMEOUT_MS2);
   const command = expand(raw, vars);
-  const args = strings3(entry2.handler["args"]).map((arg) => expand(arg, vars));
-  const shell = args.length === 0;
-  return { command, args, shell, timeoutMs, display: [command, ...args].join(" ") };
+  const args2 = strings3(entry2.handler["args"]).map((arg) => expand(arg, vars));
+  const shell = args2.length === 0;
+  return { command, args: args2, shell, timeoutMs, display: [command, ...args2].join(" ") };
 };
 var versionInvocation = (invocation) => {
   if (invocation.shell) {
@@ -13118,8 +14104,8 @@ var versionInvocation = (invocation) => {
   }
   const at = invocation.args.indexOf("hook");
   if (at < 0) return void 0;
-  const args = [...invocation.args.slice(0, at), "version", "--json"];
-  return { ...invocation, args, display: [invocation.command, ...args].join(" ") };
+  const args2 = [...invocation.args.slice(0, at), "version", "--json"];
+  return { ...invocation, args: args2, display: [invocation.command, ...args2].join(" ") };
 };
 var syntheticPayload = (event, cwd) => {
   const base = { session_id: "finitemonkey-doctor", transcript_path: "", cwd, hook_event_name: event };
@@ -13320,10 +14306,10 @@ var handlerProblems = (at, handler, claude) => {
   const type = handler["type"];
   if (typeof type !== "string" || !HANDLER_TYPES.some((known2) => known2 === type)) return [`${at}.type: unknown`];
   const problems = [];
-  const { command, args, timeout, onFailure } = handler;
+  const { command, args: args2, timeout, onFailure } = handler;
   if (type === "command" && (typeof command !== "string" || command.trim() === ""))
     problems.push(`${at}.command: empty`);
-  if (args !== void 0 && !(Array.isArray(args) && args.every((arg) => typeof arg === "string"))) {
+  if (args2 !== void 0 && !(Array.isArray(args2) && args2.every((arg) => typeof arg === "string"))) {
     problems.push(`${at}.args: not a list of strings`);
   }
   if (timeout !== void 0 && !(typeof timeout === "number" && timeout > 0))
@@ -13356,12 +14342,12 @@ var hookSchemaProblems = (hooks, claude) => {
 };
 
 // src/doctor/hook-sources.ts
-import { join as join28 } from "node:path";
+import { join as join30 } from "node:path";
 var entriesOf = (source, hooks, own) => Object.entries(asRecord(hooks)).flatMap(
   ([event, groups]) => asList(groups).flatMap((group) => {
-    const record2 = asRecord(group);
-    const matcher = optionalString(record2, "matcher");
-    return asList(record2["hooks"]).filter((handler) => isRecord(handler) && own(handler)).map((handler) => ({ source, event, matcher, handler }));
+    const record3 = asRecord(group);
+    const matcher = optionalString(record3, "matcher");
+    return asList(record3["hooks"]).filter((handler) => isRecord(handler) && own(handler)).map((handler) => ({ source, event, matcher, handler }));
   })
 );
 var PROJECT_SCOPES = { project: "project", local: "local" };
@@ -13369,10 +14355,10 @@ var projectHookFiles = (env) => readSettings(env).flatMap(({ scope: scope2, path
   const source = PROJECT_SCOPES[scope2];
   return source === void 0 || !("hooks" in settings) ? [] : [{ source, path, hooks: settings["hooks"] }];
 });
-var pluginsDir = ({ env, runtime }) => join28(env["CLAUDE_CONFIG_DIR"] ?? join28(runtime.homeDir(), ".claude"), "plugins");
+var pluginsDir = ({ env, runtime }) => join30(env["CLAUDE_CONFIG_DIR"] ?? join30(runtime.homeDir(), ".claude"), "plugins");
 var installRecord = (value, root) => {
   const records = Array.isArray(value) ? value.filter(isRecord) : isRecord(value) ? [value] : [];
-  return records.find((record2) => record2["projectPath"] === root) ?? records[0];
+  return records.find((record3) => record3["projectPath"] === root) ?? records[0];
 };
 var readJson = (env, path) => {
   const text6 = env.runtime.readText(path);
@@ -13380,18 +14366,18 @@ var readJson = (env, path) => {
   return parsed?.ok === true ? parsed.value : void 0;
 };
 var installedPlugin = (env) => {
-  const index = readJson(env, toAbsolutePath(join28(pluginsDir(env), "installed_plugins.json")));
-  const record2 = installRecord(asRecord(index?.["plugins"])[PLUGIN_ID], env.root);
-  const installPath = record2 === void 0 ? void 0 : optionalString(record2, "installPath");
-  if (record2 === void 0 || installPath === void 0) return void 0;
+  const index = readJson(env, toAbsolutePath(join30(pluginsDir(env), "installed_plugins.json")));
+  const record3 = installRecord(asRecord(index?.["plugins"])[PLUGIN_ID], env.root);
+  const installPath = record3 === void 0 ? void 0 : optionalString(record3, "installPath");
+  if (record3 === void 0 || installPath === void 0) return void 0;
   const root = toAbsolutePath(installPath);
-  const manifest = readJson(env, toAbsolutePath(join28(root, ".claude-plugin", "plugin.json")));
-  const hooksPath = toAbsolutePath(join28(root, "hooks", "hooks.json"));
+  const manifest = readJson(env, toAbsolutePath(join30(root, ".claude-plugin", "plugin.json")));
+  const hooksPath = toAbsolutePath(join30(root, "hooks", "hooks.json"));
   const text6 = env.runtime.readText(hooksPath);
   const parsed = text6.ok ? parseJsonObject(text6.value) : void 0;
   return {
     root,
-    version: (manifest === void 0 ? void 0 : optionalString(manifest, "version")) ?? optionalString(record2, "version"),
+    version: (manifest === void 0 ? void 0 : optionalString(manifest, "version")) ?? optionalString(record3, "version"),
     hooksFile: parsed?.ok === true ? { source: "plugin", path: hooksPath, hooks: parsed.value["hooks"] } : void 0,
     hooksText: text6.ok ? text6.value : void 0
   };
@@ -13431,7 +14417,7 @@ var schemaFindings = (env, plugin, claude) => {
   const files = [...projectHookFiles(env), ...plugin?.hooksFile === void 0 ? [] : [plugin.hooksFile]];
   const invalidJson = [
     ...unreadableProjectFiles(env),
-    ...plugin?.hooksText !== void 0 && plugin.hooksFile === void 0 ? [toAbsolutePath(join29(plugin.root, "hooks", "hooks.json"))] : []
+    ...plugin?.hooksText !== void 0 && plugin.hooksFile === void 0 ? [toAbsolutePath(join31(plugin.root, "hooks", "hooks.json"))] : []
   ];
   return [
     ...invalidJson.flatMap((file) => schemaFinding(file, ["not valid JSON"], label2)),
@@ -13452,7 +14438,7 @@ var pluginFindings = (env, projectOwn) => {
   ];
 };
 var coverageFindings = (env, entries) => {
-  const installed = env.runtime.stat(toAbsolutePath(join29(env.root, ...LOCK_FILE.split("/")))) !== void 0;
+  const installed = env.runtime.stat(toAbsolutePath(join31(env.root, ...LOCK_FILE.split("/")))) !== void 0;
   if (entries.length === 0 && !installed) {
     return [finding("hooks.registered", "warn", "doctor.hooks.none", {}, "doctor.hooks.fix_none")];
   }
@@ -13504,17 +14490,17 @@ var checkHooks = (env) => {
 };
 
 // src/doctor/instructions.ts
-import { join as join30 } from "node:path";
+import { join as join32 } from "node:path";
 var INSTRUCTION_LINE_CEILING = 200;
 var TOP_INSTRUCTIONS = ["AGENTS.md", "CLAUDE.md", ".claude/CLAUDE.md", "CLAUDE.local.md"];
 var RULES_DIR = ".claude/rules";
 var SHOWN = 3;
 var readProjectFile = (env, relative9) => {
-  const text6 = env.runtime.readText(toAbsolutePath(join30(env.root, ...relative9.split("/"))));
+  const text6 = env.runtime.readText(toAbsolutePath(join32(env.root, ...relative9.split("/"))));
   return text6.ok ? text6.value : void 0;
 };
 var instructionFiles = (env) => {
-  const listed4 = env.runtime.listDir(toAbsolutePath(join30(env.root, ...RULES_DIR.split("/"))));
+  const listed4 = env.runtime.listDir(toAbsolutePath(join32(env.root, ...RULES_DIR.split("/"))));
   const rules = listed4.ok ? listed4.value.filter((name) => name.endsWith(".md")).map((name) => `${RULES_DIR}/${name}`) : [];
   return [...TOP_INSTRUCTIONS, ...rules].flatMap((path) => {
     const text6 = readProjectFile(env, path);
@@ -13619,12 +14605,12 @@ var checkInstructions = (env) => {
 };
 
 // src/doctor/line-endings.ts
-import { join as join31 } from "node:path";
+import { join as join33 } from "node:path";
 var LF_RULE = /^\*\s.*\beol=lf\b/m;
 var checkLineEndings = ({ root, runtime }) => {
   const autocrlf = runtime.git(["config", "--get", "core.autocrlf"], root);
   if (!autocrlf.ok || autocrlf.stdout.trim().toLowerCase() !== "true") return [];
-  const attributes = runtime.readText(toAbsolutePath(join31(root, ".gitattributes")));
+  const attributes = runtime.readText(toAbsolutePath(join33(root, ".gitattributes")));
   if (attributes.ok && LF_RULE.test(attributes.value)) return [];
   return [
     finding("git.autocrlf", "warn", "doctor.git.autocrlf", { file: ".gitattributes" }, "doctor.git.fix_autocrlf")
@@ -13632,7 +14618,7 @@ var checkLineEndings = ({ root, runtime }) => {
 };
 
 // src/doctor/memory.ts
-import { join as join32 } from "node:path";
+import { join as join34 } from "node:path";
 var ceilingOf = (config) => {
   const value = configAt(parseConfigYaml(config ?? ""), "memory", "maxLines");
   const parsed = typeof value === "string" ? Number.parseInt(value, 10) : Number.NaN;
@@ -13640,9 +14626,9 @@ var ceilingOf = (config) => {
 };
 var lineCount2 = (text6) => text6.replace(/\r?\n$/, "").split(/\r?\n/).length;
 var checkAgentsFile = ({ root, runtime }) => {
-  const text6 = runtime.readText(toAbsolutePath(join32(root, AGENTS_FILE)));
+  const text6 = runtime.readText(toAbsolutePath(join34(root, AGENTS_FILE)));
   if (!text6.ok) return [];
-  const config = runtime.readText(toAbsolutePath(join32(root, CONFIG_FILE)));
+  const config = runtime.readText(toAbsolutePath(join34(root, CONFIG_FILE)));
   const max = ceilingOf(config.ok ? config.value : void 0);
   const lines3 = lineCount2(text6.value);
   const params2 = { file: AGENTS_FILE, lines: lines3, max };
@@ -13650,7 +14636,7 @@ var checkAgentsFile = ({ root, runtime }) => {
 };
 
 // src/doctor/project-files.ts
-import { join as join33 } from "node:path";
+import { join as join35 } from "node:path";
 var variants = (base, extensions) => extensions.map((extension) => `${base}${extension}`);
 var SCRIPT = [".js", ".cjs", ".mjs", ".ts", ".cts", ".mts"];
 var DATA = ["", ".json", ".yml", ".yaml"];
@@ -13681,7 +14667,7 @@ var CONFIG_GROUPS = [
     files: [...variants("commitlint.config", SCRIPT), ...variants(".commitlintrc", [...DATA, ".js"])]
   }
 ];
-var present = (env, files) => files.filter((file) => env.runtime.stat(toAbsolutePath(join33(env.root, file)))?.kind === "file");
+var present = (env, files) => files.filter((file) => env.runtime.stat(toAbsolutePath(join35(env.root, file)))?.kind === "file");
 var crowded = (env, groups, build) => groups.flatMap(({ name, files }) => {
   const found = present(env, files);
   return found.length > 1 ? [build(name, found.join(", "))] : [];
@@ -13742,9 +14728,9 @@ var CHECKS = [
 ];
 var probeOnce = (probe) => {
   const seen = /* @__PURE__ */ new Map();
-  return (command, args, timeoutMs) => {
-    const key = [command, ...args].join(" ");
-    const known2 = seen.get(key) ?? probe(command, args, timeoutMs);
+  return (command, args2, timeoutMs) => {
+    const key = [command, ...args2].join(" ");
+    const known2 = seen.get(key) ?? probe(command, args2, timeoutMs);
     seen.set(key, known2);
     return known2;
   };
@@ -13855,93 +14841,7 @@ var doctorCommand = {
   usage: "finitemonkey doctor [--fix] [--report] [--dry-run] [--json]",
   status: "ready",
   options: { fix: { type: "boolean" }, report: { type: "boolean" } },
-  run: (ctx, args) => Promise.resolve(runDoctor(ctx, args.values["fix"] === true, args.values["report"] === true))
-};
-
-// src/core/args.ts
-import { parseArgs } from "node:util";
-
-// src/core/problem.ts
-var usageProblem = (code, messageKey, fix, params2 = {}) => ({
-  code,
-  messageKey,
-  params: params2,
-  fix,
-  exitCode: ExitCode.Usage
-});
-var needsPersonProblem = (messageKey, fix, params2 = {}) => ({
-  code: "needs_confirmation",
-  messageKey,
-  params: params2,
-  fix,
-  exitCode: ExitCode.NeedsPerson
-});
-var FmError = class extends Error {
-  problem;
-  constructor(problem4) {
-    super(problem4.code);
-    this.name = "FmError";
-    this.problem = problem4;
-  }
-};
-
-// src/core/args.ts
-var GLOBAL_OPTIONS = {
-  json: { type: "boolean" },
-  lang: { type: "string" },
-  yes: { type: "boolean", short: "y" },
-  "dry-run": { type: "boolean" },
-  version: { type: "boolean", short: "v" },
-  help: { type: "boolean", short: "h" }
-};
-var flag = (values, name) => values[name] === true;
-var looseArgs = (argv) => {
-  const { values, positionals } = parseArgs({
-    args: [...argv],
-    options: GLOBAL_OPTIONS,
-    strict: false,
-    allowPositionals: true
-  });
-  const lang = values.lang;
-  return {
-    positionals,
-    json: flag(values, "json"),
-    yes: flag(values, "yes"),
-    dryRun: flag(values, "dry-run"),
-    version: flag(values, "version"),
-    help: flag(values, "help"),
-    lang: typeof lang === "string" ? lang : void 0
-  };
-};
-var resolveCommand = (registry, positionals) => registry.filter((spec2) => spec2.path.every((part2, index) => positionals[index] === part2)).reduce(
-  (best, spec2) => best === void 0 || spec2.path.length > best.consumed ? { spec: spec2, consumed: spec2.path.length } : best,
-  void 0
-);
-var strictArgs = (argv, spec2) => {
-  const fix = `finitemonkey help ${spec2.path.join(" ")}`;
-  let parsed;
-  try {
-    parsed = parseArgs({
-      args: [...argv],
-      options: { ...GLOBAL_OPTIONS, ...spec2.options },
-      strict: true,
-      allowPositionals: true
-    });
-  } catch (error) {
-    const detail = error instanceof Error ? error.message : String(error);
-    return reject(usageProblem("invalid_arguments", "error.invalid_arguments", fix, { detail }));
-  }
-  const rest = parsed.positionals.slice(spec2.path.length);
-  const max = spec2.maxPositionals ?? 0;
-  const extra = rest[max];
-  if (extra !== void 0) {
-    return reject(usageProblem("unexpected_argument", "error.unexpected_argument", fix, { argument: extra }));
-  }
-  return accept({ values: parsed.values, positionals: rest });
-};
-var stringOption = (values, name) => {
-  const value = values[name];
-  return typeof value === "string" ? value : void 0;
+  run: (ctx, args2) => Promise.resolve(runDoctor(ctx, args2.values["fix"] === true, args2.values["report"] === true))
 };
 
 // src/gate/baseline-run.ts
@@ -13956,8 +14856,8 @@ var runBaseline = (options) => {
   if (commands.length === 0) return { kind: "skipped", reason: "no_commands" };
   const checks = {};
   for (const check2 of commands) {
-    const outcome = runShellCheck(check2, check2.run ?? "", ctx);
-    checks[check2.id] = { exitCode: outcome.exitCode ?? null, failures: outcome.failures ?? [] };
+    const outcome2 = runShellCheck(check2, check2.run ?? "", ctx);
+    checks[check2.id] = { exitCode: outcome2.exitCode ?? null, failures: outcome2.failures ?? [] };
   }
   if (treeHash(gitAt(ctx.runtime, ctx.paths.root)) !== ctx.treeHash) return { kind: "skipped", reason: "tree_moved" };
   writeBaseline(ctx.runtime, ctx.paths, ctx.treeHash, checks);
@@ -14016,19 +14916,19 @@ var gateCommand = {
     baseline: { type: "boolean" },
     prs: { type: "boolean" }
   },
-  run: (ctx, args) => {
-    const taskId = stringOption(args.values, "task");
+  run: (ctx, args2) => {
+    const taskId = stringOption(args2.values, "task");
     const options = {
       runtime: ctx.runtime,
       cwd: ctx.cwd,
       env: ctx.env,
       sessionId: void 0,
-      budgetMs: budgetMs(stringOption(args.values, "budget")),
-      fast: args.values["fast"] === true,
+      budgetMs: budgetMs(stringOption(args2.values, "budget")),
+      fast: args2.values["fast"] === true,
       ...taskId === void 0 ? {} : { taskId }
     };
-    if (args.values["prs"] === true) return Promise.resolve(prsResult(ctx));
-    if (args.values["baseline"] === true) {
+    if (args2.values["prs"] === true) return Promise.resolve(prsResult(ctx));
+    if (args2.values["baseline"] === true) {
       const baseline = runBaseline(options);
       return Promise.resolve(
         success(baseline, [
@@ -14038,7 +14938,7 @@ var gateCommand = {
         ])
       );
     }
-    return Promise.resolve(runResult(ctx, runGate(options), args.values["strict"] === true));
+    return Promise.resolve(runResult(ctx, runGate(options), args2.values["strict"] === true));
   }
 };
 
@@ -14119,11 +15019,11 @@ var mergeVerifyCommand = {
   status: "ready",
   options: { since: { type: "string" }, dropped: { type: "string" } },
   maxPositionals: 1,
-  run: (ctx, args) => {
+  run: (ctx, args2) => {
     const repo = repoOf2(ctx);
     if (repo === void 0) return Promise.resolve(failureFrom(ctx.t, notRepository(ctx.cwd)));
-    const dropped = stringOption(args.values, "dropped");
-    const targets2 = targetsOf2(ctx, repo, args.positionals[0], stringOption(args.values, "since"));
+    const dropped = stringOption(args2.values, "dropped");
+    const targets2 = targetsOf2(ctx, repo, args2.positionals[0], stringOption(args2.values, "since"));
     if (targets2.length === 0) {
       const data = { schema: MERGE_VERIFY_RUN_SCHEMA, merges: [] };
       return Promise.resolve(success(data, [ctx.t("git.merge.none", { detail: "HEAD" })]));
@@ -14160,11 +15060,11 @@ var unreachable = (runtime, repo, shas) => {
 var fsckDangling = (runtime, repo) => {
   const result = runtime.git(["fsck", "--no-reflogs", "--no-progress", "--dangling"], repo.root);
   const lines3 = linesOf(result.stdout);
-  const pick3 = (kind) => lines3.flatMap((line2) => {
+  const pick4 = (kind) => lines3.flatMap((line2) => {
     const [label2, type, sha] = line2.split(" ");
     return label2 === "dangling" && type === kind && sha !== void 0 ? [sha] : [];
   });
-  return { commits: pick3("commit"), blobs: pick3("blob").length };
+  return { commits: pick4("commit"), blobs: pick4("blob").length };
 };
 var describe = (runtime, repo, shas) => {
   if (shas.length === 0) return /* @__PURE__ */ new Map();
@@ -14231,11 +15131,11 @@ var rescueCommand = {
   usage: "finitemonkey rescue [--restore <sha> --branch <name>] [--json]",
   status: "ready",
   options: { restore: { type: "string" }, branch: { type: "string" } },
-  run: (ctx, args) => {
+  run: (ctx, args2) => {
     const repo = repoOf2(ctx);
     if (repo === void 0) return Promise.resolve(failureFrom(ctx.t, notRepository(ctx.cwd)));
-    const sha = stringOption(args.values, "restore");
-    const branch = stringOption(args.values, "branch");
+    const sha = stringOption(args2.values, "restore");
+    const branch = stringOption(args2.values, "branch");
     if (sha === void 0 && branch === void 0) {
       const report2 = rescueReport(ctx.runtime, repo);
       return Promise.resolve(success({ schema: RESCUE_SCHEMA, action: "list", ...report2 }, listing(ctx.t, report2)));
@@ -14264,10 +15164,10 @@ var rescueCommand = {
 };
 
 // src/git/undo.ts
-import { basename as basename3, dirname as dirname8, join as join34 } from "node:path";
+import { basename as basename3, dirname as dirname8, join as join36 } from "node:path";
 var INDEX_SUBJECT = "finitemonkey index:";
-var gitLine = (runtime, repo, args) => {
-  const result = runtime.git(args, repo.root);
+var gitLine = (runtime, repo, args2) => {
+  const result = runtime.git(args2, repo.root);
   const value = result.stdout.trim();
   return result.ok && value !== "" ? value : void 0;
 };
@@ -14307,7 +15207,7 @@ var findSnapshot = (views, wanted) => {
 };
 var stampOf2 = (iso) => iso.replace(/[:.]/g, "-");
 var worktreePath = (runtime, repo) => {
-  const base = join34(dirname8(repo.root), `${basename3(repo.root)}-undo-${stampOf2(runtime.now())}`);
+  const base = join36(dirname8(repo.root), `${basename3(repo.root)}-undo-${stampOf2(runtime.now())}`);
   return toAbsolutePath(runtime.stat(toAbsolutePath(base)) === void 0 ? base : `${base}-2`);
 };
 var intoWorktree = (runtime, repo, view2) => {
@@ -14315,13 +15215,13 @@ var intoWorktree = (runtime, repo, view2) => {
   const added = runtime.gitWith(["worktree", "add", "--detach", path, view2.commit], repo.root, {});
   return added.ok ? accept(path) : reject(failure2("worktree add", added));
 };
-var step2 = (runtime, repo, args) => {
-  const result = runtime.gitWith(args, repo.root, {});
-  return result.ok ? accept(void 0) : reject(failure2(args.join(" "), result));
+var step2 = (runtime, repo, args2) => {
+  const result = runtime.gitWith(args2, repo.root, {});
+  return result.ok ? accept(void 0) : reject(failure2(args2.join(" "), result));
 };
 var inPlace = (runtime, repo, view2) => {
-  const current = gitLine(runtime, repo, ["rev-parse", "--verify", "--quiet", "HEAD"]);
-  if (view2.head !== void 0 && view2.head !== current) {
+  const current2 = gitLine(runtime, repo, ["rev-parse", "--verify", "--quiet", "HEAD"]);
+  if (view2.head !== void 0 && view2.head !== current2) {
     const moved = step2(runtime, repo, ["reset", "--soft", view2.head]);
     if (!moved.ok) return moved;
   }
@@ -14350,10 +15250,10 @@ var snapshotCommand = {
   usage: "finitemonkey snapshot [--message <text>] [--json]",
   status: "ready",
   options: { message: { type: "string", short: "m" } },
-  run: (ctx, args) => {
+  run: (ctx, args2) => {
     const repo = repoOf2(ctx);
     if (repo === void 0) return Promise.resolve(failureFrom(ctx.t, notRepository(ctx.cwd)));
-    const message = args.values["message"];
+    const message = args2.values["message"];
     const op = typeof message === "string" && message.trim() !== "" ? message.trim() : "manual";
     const taken = takeSnapshot(ctx.runtime, repo, { op });
     if (!taken.ok) {
@@ -14383,12 +15283,12 @@ var undoCommand = {
   status: "ready",
   options: { list: { type: "boolean" }, "in-place": { type: "boolean" } },
   maxPositionals: 1,
-  run: (ctx, args) => {
+  run: (ctx, args2) => {
     const repo = repoOf2(ctx);
     if (repo === void 0) return Promise.resolve(failureFrom(ctx.t, notRepository(ctx.cwd)));
     const views = snapshotViews(ctx.runtime, repo);
-    if (args.values["list"] === true) return Promise.resolve(listResult(ctx, views));
-    const wanted = args.positionals[0];
+    if (args2.values["list"] === true) return Promise.resolve(listResult(ctx, views));
+    const wanted = args2.positionals[0];
     const view2 = findSnapshot(views, wanted);
     if (view2 === void 0) {
       return Promise.resolve(
@@ -14401,7 +15301,7 @@ var undoCommand = {
         })
       );
     }
-    const inPlace2 = args.values["in-place"] === true;
+    const inPlace2 = args2.values["in-place"] === true;
     if (inPlace2 && !(ctx.yes && isPerson(ctx))) {
       return Promise.resolve(
         failureFrom(ctx.t, needsPersonProblem("git.undo.confirm", `finitemonkey undo ${view2.ref} --in-place --yes`))
@@ -14490,8 +15390,8 @@ var helpCommand = {
   usage: "finitemonkey help [command]",
   status: "ready",
   maxPositionals: 3,
-  run: (ctx, args, registry) => Promise.resolve(
-    args.positionals.length === 0 ? overview(ctx, registry) : topicHelp(ctx, registry, args.positionals)
+  run: (ctx, args2, registry) => Promise.resolve(
+    args2.positionals.length === 0 ? overview(ctx, registry) : topicHelp(ctx, registry, args2.positionals)
   )
 };
 
@@ -14503,8 +15403,8 @@ var hookCommand = {
   status: "ready",
   maxPositionals: 1,
   options: { via: { type: "string" } },
-  run: async (ctx, args) => {
-    const raw = args.positionals[0] ?? "";
+  run: async (ctx, args2) => {
+    const raw = args2.positionals[0] ?? "";
     const event = parseHookEvent(raw);
     if (event === void 0) {
       const params2 = { event: raw, events: HOOK_EVENTS.join(", ") };
@@ -14513,10 +15413,10 @@ var hookCommand = {
         usageProblem("unknown_hook_event", "error.unknown_hook_event", "finitemonkey help hook", params2)
       );
     }
-    if (stringOption(args.values, "via") === PLUGIN_VIA && projectOwnsHooks(ctx)) {
+    if (stringOption(args2.values, "via") === PLUGIN_VIA && projectOwnsHooks(ctx)) {
       return { ok: true, exitCode: 0, data: { event, verdict: "allow" }, raw: { stdout: YIELD_STDOUT, stderr: "" } };
     }
-    const outcome = await runHook(event, {
+    const outcome2 = await runHook(event, {
       stdin: ctx.io.stdin,
       deadlineMs: deadlineFor(event, ctx.env["FINITEMONKEY_HOOK_DEADLINE_MS"]),
       handlers: DEFAULT_HANDLERS,
@@ -14526,11 +15426,11 @@ var hookCommand = {
       runtime: ctx.runtime,
       env: ctx.env
     });
-    logHookFailure(ctx, event, outcome);
-    const data = { event, verdict: outcome.verdict };
-    const output = { stdout: outcome.stdout, stderr: outcome.stderr };
-    if (outcome.exitCode === 0) return { ok: true, exitCode: 0, data, raw: output };
-    const message = outcome.stderr.trim();
+    logHookFailure(ctx, event, outcome2);
+    const data = { event, verdict: outcome2.verdict };
+    const output = { stdout: outcome2.stdout, stderr: outcome2.stderr };
+    if (outcome2.exitCode === 0) return { ok: true, exitCode: 0, data, raw: output };
+    const message = outcome2.stderr.trim();
     return {
       ok: false,
       exitCode: 2,
@@ -14542,7 +15442,7 @@ var hookCommand = {
 };
 
 // src/commands/i18n-check.ts
-import { join as join35 } from "node:path";
+import { join as join37 } from "node:path";
 
 // src/i18n/message.ts
 var ARG = /^\s*([a-zA-Z][a-zA-Z0-9_]*)\s*(?:,\s*(plural|select)\s*,)?/;
@@ -14744,7 +15644,7 @@ var unreadable = (dir, file, detail) => ({
   exitCode: ExitCode.NotConfigured
 });
 var readCatalog = (ctx, dir, lang) => {
-  const file = toAbsolutePath(join35(dir, `${lang}.json`));
+  const file = toAbsolutePath(join37(dir, `${lang}.json`));
   const text6 = ctx.runtime.readText(file);
   if (!text6.ok) return reject(unreadable(dir, file, text6.error));
   const parsed = parseJsonObject(text6.value);
@@ -14767,7 +15667,7 @@ var describeProblem = (ctx, problem4) => {
   return `  ${problem4.lang}  ${problem4.key}  ${kind}`;
 };
 var loadReview = (ctx, dir) => {
-  const text6 = ctx.runtime.readText(toAbsolutePath(join35(dir, "review.json")));
+  const text6 = ctx.runtime.readText(toAbsolutePath(join37(dir, "review.json")));
   const parsed = text6.ok ? parseJsonObject(text6.value) : void 0;
   if (parsed?.ok !== true) return void 0;
   const statuses = (lang) => {
@@ -14801,17 +15701,17 @@ var i18nCheckCommand = {
   usage: "finitemonkey i18n check [--dir <path>]",
   status: "ready",
   options: { dir: { type: "string" } },
-  run: (ctx, args) => {
-    const dir = stringOption(args.values, "dir");
+  run: (ctx, args2) => {
+    const dir = stringOption(args2.values, "dir");
     return Promise.resolve(runI18nCheck(ctx, dir === void 0 ? void 0 : toAbsolutePath(dir, ctx.cwd)));
   }
 };
 
 // src/history/look-back.ts
-import { join as join36 } from "node:path";
+import { join as join38 } from "node:path";
 
 // src/history/patterns.ts
-import { posix as posix4 } from "node:path";
+import { posix as posix5 } from "node:path";
 var PATTERNS = ["done_after_failing_tests", "env_read", "no_verify", "force_push", "test_skip"];
 var TEST_COMMAND = /(^|[\s;&|(])((npm|pnpm|yarn|bun)\s+(run\s+)?(test|check)\b|npx\s+(vitest|jest)\b|vitest\b|jest\b|pytest\b|go\s+test\b|cargo\s+test\b|node\s+--test\b|mocha\b)/;
 var DONE_CLAIM = /\b(done|all (tests|checks) (pass|passed|are passing)|everything (passes|works)|it works|pronto|feito|conclu[ií]do|listo|terminado)\b/i;
@@ -14833,7 +15733,7 @@ var stringField = (tool, name) => {
   return typeof value === "string" ? value : "";
 };
 var isEnvPath = (path) => {
-  const name = posix4.basename(path.replace(/\\/g, "/"));
+  const name = posix5.basename(path.replace(/\\/g, "/"));
   return /^\.env(\.[A-Za-z0-9_-]+)?$/.test(name) && !ENV_TEMPLATE.test(name);
 };
 var envRead = (tool) => {
@@ -14921,7 +15821,7 @@ var addResults = (draft, blocks) => {
 };
 var parseTranscript = (jsonl) => {
   const turns = [];
-  let current;
+  let current2;
   for (const line2 of jsonl.split(/\r?\n/)) {
     if (line2.trim() === "") continue;
     const parsed = parseJsonObject(line2);
@@ -14929,13 +15829,13 @@ var parseTranscript = (jsonl) => {
     const entry2 = parsed.value;
     const blocks = blocksOf(entry2["message"]);
     if (entry2["type"] === "user") {
-      if (current !== void 0 && addResults(current, blocks)) continue;
+      if (current2 !== void 0 && addResults(current2, blocks)) continue;
       const prompt = blocks.map(textOf3).join("\n").trim();
       if (prompt === "") continue;
-      current = startTurn(prompt);
-      turns.push(current);
-    } else if (entry2["type"] === "assistant" && current !== void 0) {
-      addAssistant(current, blocks);
+      current2 = startTurn(prompt);
+      turns.push(current2);
+    } else if (entry2["type"] === "assistant" && current2 !== void 0) {
+      addAssistant(current2, blocks);
     }
   }
   return turns;
@@ -14944,7 +15844,7 @@ var parseTranscript = (jsonl) => {
 // src/history/look-back.ts
 var SAMPLES = 3;
 var projectLogKey = (root) => root.replace(/[^A-Za-z0-9-]/g, "-");
-var projectLogDir = (runtime, root, env) => join36(env["CLAUDE_CONFIG_DIR"] ?? join36(runtime.homeDir(), ".claude"), "projects", projectLogKey(root));
+var projectLogDir = (runtime, root, env) => join38(env["CLAUDE_CONFIG_DIR"] ?? join38(runtime.homeDir(), ".claude"), "projects", projectLogKey(root));
 var lookBack = (runtime, root, env) => {
   const dir = projectLogDir(runtime, root, env);
   const listed4 = runtime.listDir(toAbsolutePath(dir));
@@ -14965,7 +15865,7 @@ var lookBack = (runtime, root, env) => {
   };
   let turns = 0;
   for (const name of files) {
-    const text6 = runtime.readText(toAbsolutePath(join36(dir, name)));
+    const text6 = runtime.readText(toAbsolutePath(join38(dir, name)));
     if (!text6.ok) continue;
     for (const turn of parseTranscript(text6.value)) {
       turns += 1;
@@ -15146,11 +16046,11 @@ var runInstall = (ctx, request, presetFallback) => {
   if (ctx.dryRun || !ctx.yes || !needsWrite(plan.value)) return presentPlan(ctx, request, plan.value);
   return applyAndReport(ctx, request, plan.value);
 };
-var initRequest = (args) => ({
+var initRequest = (args2) => ({
   mode: "init",
-  preset: stringOption(args.values, "preset"),
-  bin: stringOption(args.values, "bin"),
-  marketplace: args.values["marketplace"] === true,
+  preset: stringOption(args2.values, "preset"),
+  bin: stringOption(args2.values, "bin"),
+  marketplace: args2.values["marketplace"] === true,
   showDiff: false
 });
 var withLookBack = (ctx, result) => {
@@ -15175,10 +16075,36 @@ var initCommand = {
     marketplace: { type: "boolean" },
     "look-back": { type: "boolean" }
   },
-  run: (ctx, args) => {
-    const result = runInstall(ctx, initRequest(args), "neutral");
-    return Promise.resolve(args.values["look-back"] === true ? withLookBack(ctx, result) : result);
-  }
+  run: (ctx, args2) => {
+    const result = runInstall(ctx, initRequest(args2), "neutral");
+    return Promise.resolve(args2.values["look-back"] === true ? withLookBack(ctx, result) : result);
+  }
+};
+
+// src/commands/policy.ts
+var FIX = `finitemonkey policy false-positive <${OPTIONAL_GUARDS.join("|")}>`;
+var recordFalsePositive = (ctx, guard) => {
+  if (!isPerson(ctx)) return failureFrom(ctx.t, needsPersonProblem("policy.error.person_only", FIX));
+  if (!OPTIONAL_GUARDS.some((id) => id === guard)) {
+    return failureFrom(ctx.t, usageProblem("invalid_arguments", "error.invalid_arguments", FIX, { detail: guard }));
+  }
+  const paths = fmPaths(findRepoRoot(ctx.runtime, ctx.cwd) ?? ctx.cwd);
+  const state = readShadow(ctx.runtime, paths);
+  const before = state[guard] ?? { firings: 0, falsePositives: 0, promoted: false };
+  const falsePositives = before.falsePositives + 1;
+  writeShadow(ctx.runtime, paths, { ...state, [guard]: { ...before, falsePositives } });
+  logEvent(ctx.runtime, paths, "guard_false_positive", { guard, falsePositives });
+  return success({ guard, falsePositives }, [
+    ctx.t("policy.false_positive.recorded", { guard, count: falsePositives })
+  ]);
+};
+var policyFalsePositiveCommand = {
+  path: ["policy", "false-positive"],
+  summaryKey: "command.policy_false_positive.summary",
+  usage: FIX,
+  status: "ready",
+  maxPositionals: 1,
+  run: (ctx, args2) => Promise.resolve(recordFalsePositive(ctx, args2.positionals[0] ?? ""))
 };
 
 // src/commands/prose-check.ts
@@ -15304,10 +16230,10 @@ var proseCheckCommand = {
   status: "ready",
   options: { stdin: { type: "boolean" }, record: { type: "boolean" } },
   maxPositionals: 1e3,
-  run: async (ctx, args) => {
+  run: async (ctx, args2) => {
     const root = projectRoot(ctx);
-    const mode = { stdin: args.values["stdin"] === true, record: args.values["record"] === true };
-    const reports = await reportsOf(ctx, root, args.positionals, mode);
+    const mode = { stdin: args2.values["stdin"] === true, record: args2.values["record"] === true };
+    const reports = await reportsOf(ctx, root, args2.positionals, mode);
     if (!reports.ok) return failureFrom(ctx.t, reports.error);
     return resultOf2(ctx, reports.value);
   }
@@ -15362,7 +16288,7 @@ var inputProblem = (ctx, id, reason, days) => {
   }
   return void 0;
 };
-var entryOf3 = (ctx, finding3, args) => {
+var entryOf3 = (ctx, finding3, args2) => {
   const now = ctx.runtime.now();
   return {
     id: finding3.id,
@@ -15370,30 +16296,30 @@ var entryOf3 = (ctx, finding3, args) => {
     file: finding3.file,
     line: finding3.line,
     fingerprint: finding3.fingerprint,
-    state: args.falsePositive ? "falso-positivo" : "aceito",
+    state: args2.falsePositive ? "falso-positivo" : "aceito",
     owner: personName(ctx),
-    reason: args.reason,
+    reason: args2.reason,
     acceptedAt: now,
-    expiresAt: plusDays(now, args.days)
+    expiresAt: plusDays(now, args2.days)
   };
 };
-var acceptEntry = (ctx, args) => {
+var acceptEntry = (ctx, args2) => {
   const root = projectRoot(ctx);
   const baseline = loadBaseline(ctx.runtime, root);
   if (!baseline.ok) {
     return failure3(ctx, baselineInvalid(baseline.error));
   }
   const scanned = scanPath(ctx.runtime, root, ".");
-  const finding3 = scanned.ok ? scanned.value.find((item) => item.id === args.id) : void 0;
+  const finding3 = scanned.ok ? scanned.value.find((item) => item.id === args2.id) : void 0;
   if (finding3 === void 0) {
     return failure3(
       ctx,
       usageProblem("secrets_finding_not_found", "secrets.error.finding_not_found", "finitemonkey secrets scan", {
-        id: args.id
+        id: args2.id
       })
     );
   }
-  const entry2 = entryOf3(ctx, finding3, args);
+  const entry2 = entryOf3(ctx, finding3, args2);
   const entries = [...baseline.value.entries.filter((item) => item.id !== entry2.id), entry2];
   const saved = saveBaseline(ctx.runtime, root, { schema: baseline.value.schema, entries });
   if (!saved.ok) {
@@ -15416,10 +16342,10 @@ var secretsAcceptCommand = {
   status: "ready",
   maxPositionals: 1,
   options: { reason: { type: "string" }, days: { type: "string" }, "false-positive": { type: "boolean" } },
-  run: (ctx, args) => {
-    const id = args.positionals[0] ?? "";
-    const reason = stringOption(args.values, "reason");
-    const days = daysOf(args.values);
+  run: (ctx, args2) => {
+    const id = args2.positionals[0] ?? "";
+    const reason = stringOption(args2.values, "reason");
+    const days = daysOf(args2.values);
     const problem4 = inputProblem(ctx, id, reason, days);
     if (problem4 !== void 0 || reason === void 0 || days === void 0) {
       return Promise.resolve(
@@ -15430,7 +16356,7 @@ var secretsAcceptCommand = {
       );
     }
     return Promise.resolve(
-      acceptEntry(ctx, { id, reason, days, falsePositive: args.values["false-positive"] === true })
+      acceptEntry(ctx, { id, reason, days, falsePositive: args2.values["false-positive"] === true })
     );
   }
 };
@@ -15511,18 +16437,18 @@ var secretsIncidentCommand = {
   usage: USAGE,
   status: "ready",
   maxPositionals: 2,
-  run: (ctx, args) => {
-    const action = actionOf(args.positionals[0]);
+  run: (ctx, args2) => {
+    const action = actionOf(args2.positionals[0]);
     const root = projectRoot(ctx);
     if (action === void 0)
       return Promise.resolve(
         fail2(
           ctx,
-          usageProblem("invalid_arguments", "error.invalid_arguments", USAGE, { detail: args.positionals[0] ?? "" })
+          usageProblem("invalid_arguments", "error.invalid_arguments", USAGE, { detail: args2.positionals[0] ?? "" })
         )
       );
     if (action === "list") return Promise.resolve(list2(ctx, root));
-    const id = args.positionals[1] ?? "";
+    const id = args2.positionals[1] ?? "";
     const incident = readIncident(ctx.runtime, root, id);
     if (!incident.ok) return Promise.resolve(notFound2(ctx, id));
     return Promise.resolve(action === "purge" ? purge(ctx, incident.value) : move(ctx, root, incident.value, action));
@@ -15543,7 +16469,7 @@ var view = (finding3, status) => ({
   status,
   ...finding3.commit === void 0 ? {} : { commit: finding3.commit }
 });
-var modeOf2 = (values) => {
+var modeOf3 = (values) => {
   const chosen = [values["staged"] === true, values["history"] === true, stringOption(values, "path") !== void 0];
   if (chosen.filter(Boolean).length > 1) return void 0;
   if (chosen[0] === true) return "staged";
@@ -15572,25 +16498,25 @@ var historyIncidents = (ctx, root, fresh3) => fresh3.flatMap((finding3) => {
   const saved = recordIncident(ctx.runtime, root, draft, HOOK_ACTOR);
   return saved.ok ? [saved.value.id] : [];
 });
-var dataOf = (mode, outcome, incidents) => {
+var dataOf = (mode, outcome2, incidents) => {
   const findings = [
-    ...outcome.fresh.map((finding3) => view(finding3, "new")),
-    ...outcome.known.map((finding3) => view(finding3, "known")),
-    ...outcome.expired.map((finding3) => view(finding3, "expired"))
+    ...outcome2.fresh.map((finding3) => view(finding3, "new")),
+    ...outcome2.known.map((finding3) => view(finding3, "known")),
+    ...outcome2.expired.map((finding3) => view(finding3, "expired"))
   ];
   return {
     schema: SECRETS_SCAN_SCHEMA,
     mode,
     baseline: BASELINE_FILE2,
     findings,
-    fixed: outcome.fixed.map((entry2) => entry2.id),
+    fixed: outcome2.fixed.map((entry2) => entry2.id),
     incidents,
     summary: {
       total: findings.length,
-      new: outcome.fresh.length,
-      known: outcome.known.length,
-      expired: outcome.expired.length,
-      fixed: outcome.fixed.length
+      new: outcome2.fresh.length,
+      known: outcome2.known.length,
+      expired: outcome2.expired.length,
+      fixed: outcome2.fixed.length
     }
   };
 };
@@ -15624,8 +16550,8 @@ var resultOf3 = (ctx, data) => {
     human2
   );
 };
-var prune = (ctx, root, baseline, outcome) => {
-  if (outcome.fixed.length > 0) saveBaseline(ctx.runtime, root, withoutFixed(baseline, outcome.fixed));
+var prune = (ctx, root, baseline, outcome2) => {
+  if (outcome2.fixed.length > 0) saveBaseline(ctx.runtime, root, withoutFixed(baseline, outcome2.fixed));
 };
 var secretsScanCommand = {
   path: ["secrets", "scan"],
@@ -15633,30 +16559,30 @@ var secretsScanCommand = {
   usage: "finitemonkey secrets scan [--staged | --history | --path <dir>] [--json]",
   status: "ready",
   options: { staged: { type: "boolean" }, history: { type: "boolean" }, path: { type: "string" } },
-  run: async (ctx, args) => {
-    const mode = modeOf2(args.values);
+  run: async (ctx, args2) => {
+    const mode = modeOf3(args2.values);
     const fix = "finitemonkey help secrets scan";
     if (mode === void 0) return failureFrom(ctx.t, usageProblem("invalid_arguments", "secrets.error.one_mode", fix));
     const root = projectRoot(ctx);
-    const target = stringOption(args.values, "path") ?? ".";
+    const target = stringOption(args2.values, "path") ?? ".";
     const scanned = await runScan(ctx, root, mode, target);
     if (!scanned.ok) return failureFrom(ctx.t, gitUnavailable(scanned.error));
     const baseline = loadBaseline(ctx.runtime, root);
     if (!baseline.ok) return failureFrom(ctx.t, baselineInvalid(baseline.error));
-    const outcome = ratchet(
+    const outcome2 = ratchet(
       scanned.value,
       baseline.value,
       ctx.runtime.now(),
       mode === "path" ? scopeOf(target) : void 0
     );
-    if (mode === "path") prune(ctx, root, baseline.value, outcome);
-    const incidents = mode === "history" ? historyIncidents(ctx, root, outcome.fresh) : [];
-    return resultOf3(ctx, dataOf(mode, outcome, incidents));
+    if (mode === "path") prune(ctx, root, baseline.value, outcome2);
+    const incidents = mode === "history" ? historyIncidents(ctx, root, outcome2.fresh) : [];
+    return resultOf3(ctx, dataOf(mode, outcome2, incidents));
   }
 };
 
 // src/task/create.ts
-import { join as join37 } from "node:path";
+import { join as join39 } from "node:path";
 
 // src/core/yaml/write.ts
 var PLAIN_SAFE = /^[A-Za-z_./][A-Za-z0-9_./ ()-]*$/;
@@ -15702,7 +16628,11 @@ var checkYaml = (check2) => ({
   ...check2.timeoutS === void 0 ? {} : { timeout_s: check2.timeoutS },
   ...check2.require === void 0 ? {} : { require: [...check2.require] },
   ...check2.requireOpen === void 0 ? {} : { require_open: check2.requireOpen },
-  ...check2.description === void 0 ? {} : { description: check2.description }
+  ...check2.description === void 0 ? {} : { description: check2.description },
+  ...check2.port === void 0 ? {} : { port: check2.port },
+  ...check2.route === void 0 ? {} : { route: check2.route },
+  ...check2.status === void 0 ? {} : { status: check2.status },
+  ...check2.body === void 0 ? {} : { body: check2.body }
 });
 var contractYaml = (contract) => ({
   id: contract.id,
@@ -15715,7 +16645,8 @@ var contractYaml = (contract) => ({
     tests_protected: contract.scope.testsProtected
   },
   acceptance: contract.acceptance.map(checkYaml),
-  decisions_needed: [...contract.decisionsNeeded]
+  decisions_needed: [...contract.decisionsNeeded],
+  ...contract.callersIgnore === void 0 ? {} : { callers_ignore: [...contract.callersIgnore] }
 });
 var contractJson = (contract) => ({
   id: contract.id,
@@ -15740,10 +16671,10 @@ var explicitChecks = (draft) => [
 var draftChecks = (runtime, paths, draft) => {
   const disk = {
     read: (relative9) => {
-      const text6 = runtime.readText(toAbsolutePath(join37(paths.root, relative9)));
+      const text6 = runtime.readText(toAbsolutePath(join39(paths.root, relative9)));
       return text6.ok ? text6.value : void 0;
     },
-    exists: (relative9) => runtime.stat(toAbsolutePath(join37(paths.root, relative9))) !== void 0
+    exists: (relative9) => runtime.stat(toAbsolutePath(join39(paths.root, relative9))) !== void 0
   };
   const detected = detectChecks(disk);
   const base = draft.runs.length > 0 || draft.tests !== void 0 ? explicitChecks(draft) : detected;
@@ -15756,6 +16687,7 @@ var draftChecks = (runtime, paths, draft) => {
     { id: "prose", kind: "prose" },
     { id: "worktree", kind: "worktree" },
     { id: "merge", kind: "merge" },
+    { id: "callers", kind: "callers" },
     ...draft.paths.length > 0 || draft.budget !== void 0 ? [{ id: "diff", kind: "diff" }] : [],
     ...draft.git.length > 0 ? [{ id: "git", kind: "git", require: draft.git }] : [],
     { id: "pr", kind: "pr", requireOpen: draft.git.includes("pr_open") },
@@ -15816,13 +16748,13 @@ var list3 = (values, name) => {
   return raw.filter((item) => typeof item === "string" && item.trim() !== "");
 };
 var csv = (values, name) => list3(values, name).flatMap((item) => item.split(",").map((part2) => part2.trim())).filter((part2) => part2 !== "");
-var positive2 = (values, name) => {
+var positive3 = (values, name) => {
   const parsed = Number.parseInt(stringOption(values, name) ?? "", 10);
   return Number.isFinite(parsed) && parsed > 0 ? parsed : void 0;
 };
 var draftFrom = (ctx, paths, id, values) => {
-  const files = positive2(values, "budget-files");
-  const lines3 = positive2(values, "budget-lines");
+  const files = positive3(values, "budget-files");
+  const lines3 = positive3(values, "budget-lines");
   const size = SIZES.find((item) => item === stringOption(values, "size")) ?? "S";
   return {
     id,
@@ -15925,7 +16857,7 @@ var taskNewCommand = {
   status: "ready",
   options: TASK_OPTIONS,
   maxPositionals: 1,
-  run: (ctx, args) => Promise.resolve(newTask(ctx, args.positionals[0], args.values))
+  run: (ctx, args2) => Promise.resolve(newTask(ctx, args2.positionals[0], args2.values))
 };
 var taskShowCommand = {
   path: ["task", "show"],
@@ -15933,7 +16865,7 @@ var taskShowCommand = {
   usage: "finitemonkey task show [<id>]",
   status: "ready",
   maxPositionals: 1,
-  run: (ctx, args) => Promise.resolve(showTask(ctx, args.positionals[0]))
+  run: (ctx, args2) => Promise.resolve(showTask(ctx, args2.positionals[0]))
 };
 var taskDoneCommand = {
   path: ["task", "done"],
@@ -15941,19 +16873,19 @@ var taskDoneCommand = {
   usage: "finitemonkey task done [<id>]",
   status: "ready",
   maxPositionals: 1,
-  run: (ctx, args) => Promise.resolve(doneTask(ctx, args.positionals[0]))
+  run: (ctx, args2) => Promise.resolve(doneTask(ctx, args2.positionals[0]))
 };
 
 // src/install/uninstall.ts
-var structural = (entry2, current) => {
+var structural = (entry2, current2) => {
   if (entry2.kind === "gitignore" || entry2.kind === "markdown") {
-    const text6 = entry2.kind === "gitignore" ? withoutBlock(current) : withoutMarkdownBlock(current);
+    const text6 = entry2.kind === "gitignore" ? withoutBlock(current2) : withoutMarkdownBlock(current2);
     return text6 === "" && !entry2.existed ? void 0 : text6;
   }
-  const parsed = parseSettings(current);
-  if (!parsed.ok || entry2.added === void 0) return current;
+  const parsed = parseSettings(current2);
+  if (!parsed.ok || entry2.added === void 0) return current2;
   const settings = unmergeSettings(parsed.value, entry2.added, entry2.handlers ?? []);
-  return Object.keys(settings).length === 0 && !entry2.existed ? void 0 : renderJson(settings, styleOf(current));
+  return Object.keys(settings).length === 0 && !entry2.existed ? void 0 : renderJson(settings, styleOf(current2));
 };
 var unchanged = (project, entry2) => {
   if (!entry2.existed) return { path: entry2.path, action: "delete", after: void 0 };
@@ -15961,17 +16893,17 @@ var unchanged = (project, entry2) => {
   return original === void 0 ? void 0 : { path: entry2.path, action: "restore", after: original };
 };
 var removalFor = (project, entry2, options) => {
-  const current = project.read(entry2.path);
-  if (current === void 0) return { path: entry2.path, action: "gone", after: void 0 };
+  const current2 = project.read(entry2.path);
+  if (current2 === void 0) return { path: entry2.path, action: "gone", after: void 0 };
   if (entry2.kind === "generated" && options.keepGenerated) {
-    return { path: entry2.path, action: "keep-generated", after: current };
+    return { path: entry2.path, action: "keep-generated", after: current2 };
   }
-  if (hashText(current) === entry2.hash) {
+  if (hashText(current2) === entry2.hash) {
     const exact2 = unchanged(project, entry2);
     if (exact2 !== void 0) return exact2;
   }
-  if (entry2.kind === "generated") return { path: entry2.path, action: "keep-edited", after: current };
-  const after = structural(entry2, current);
+  if (entry2.kind === "generated") return { path: entry2.path, action: "keep-edited", after: current2 };
+  const after = structural(entry2, current2);
   return { path: entry2.path, action: after === void 0 ? "delete" : "unmerge", after };
 };
 var planRemoval = (project, lock, options) => ({
@@ -15991,7 +16923,7 @@ var isEmptyDir = (project, relative9) => {
   const listed4 = project.runtime.listDir(project.abs(relative9));
   return listed4.ok && listed4.value.length === 0;
 };
-var finish2 = (project, plan) => {
+var finish3 = (project, plan) => {
   const target = plan.purge ? STATE_DIR : LOCK_FILE;
   const removed = project.runtime.remove(project.abs(target));
   if (!removed.ok) return reject({ path: target, detail: removed.error });
@@ -16006,7 +16938,7 @@ var applyRemoval = (project, plan) => {
     }
     return accept(void 0);
   });
-  return changed.ok ? finish2(project, plan) : changed;
+  return changed.ok ? finish3(project, plan) : changed;
 };
 
 // src/commands/uninstall.ts
@@ -16037,22 +16969,22 @@ var linesOf2 = (ctx, data) => [
   ctx.t("install.uninstall.outside"),
   ...OUTSIDE.map(({ key, command }) => `  ${ctx.t(key, { command })}`)
 ];
-var fixFor = (args) => [
+var fixFor = (args2) => [
   "finitemonkey uninstall --yes",
-  ...args.values["purge"] === true ? ["--purge"] : [],
-  ...args.values["keep-generated"] === true ? ["--keep-generated"] : []
+  ...args2.values["purge"] === true ? ["--purge"] : [],
+  ...args2.values["keep-generated"] === true ? ["--keep-generated"] : []
 ].join(" ");
-var runUninstall = (ctx, args) => {
+var runUninstall = (ctx, args2) => {
   const { project } = openProject(ctx);
   const lock = readPreviousLock(project);
   if (!lock.ok) return failureFrom(ctx.t, planProblem(lock.error));
   if (lock.value === void 0) return failureFrom(ctx.t, notInstalled());
-  const options = { purge: args.values["purge"] === true, keepGenerated: args.values["keep-generated"] === true };
+  const options = { purge: args2.values["purge"] === true, keepGenerated: args2.values["keep-generated"] === true };
   const plan = planRemoval(project, lock.value, options);
   const preview = dataOf2(project.root, plan, false);
   if (ctx.dryRun) return success(preview, [...linesOf2(ctx, preview), ctx.t("install.dry_run")]);
   if (!ctx.yes) {
-    const next2 = fixFor(args);
+    const next2 = fixFor(args2);
     const problem4 = confirmProblem("uninstall", ctx.t("install.uninstall.question"), next2);
     return { ...failureFrom(ctx.t, { ...problem4, data: preview }, linesOf2(ctx, preview)), next: next2 };
   }
@@ -16067,7 +16999,7 @@ var uninstallCommand = {
   usage: "finitemonkey uninstall [--purge] [--keep-generated] [--dry-run] [--yes]",
   status: "ready",
   options: { purge: { type: "boolean" }, "keep-generated": { type: "boolean" } },
-  run: (ctx, args) => Promise.resolve(runUninstall(ctx, args))
+  run: (ctx, args2) => Promise.resolve(runUninstall(ctx, args2))
 };
 
 // src/commands/update.ts
@@ -16090,14 +17022,14 @@ var check = (ctx, bin) => {
     error: { code: "install_outdated", message: ctx.t("error.install_outdated"), fix: "finitemonkey update --yes" }
   };
 };
-var runUpdate = (ctx, args) => {
-  const bin = stringOption(args.values, "bin");
-  if (args.values["check"] === true) return check(ctx, bin);
+var runUpdate = (ctx, args2) => {
+  const bin = stringOption(args2.values, "bin");
+  if (args2.values["check"] === true) return check(ctx, bin);
   const { project } = openProject(ctx);
   const previous = readPreviousLock(project);
   if (!previous.ok) return failureFrom(ctx.t, planProblem(previous.error));
   if (previous.value === void 0) return failureFrom(ctx.t, notInstalled());
-  const preset = stringOption(args.values, "preset");
+  const preset = stringOption(args2.values, "preset");
   const request = { mode: "update", preset, bin, marketplace: false, showDiff: true };
   return runInstall(ctx, request, previous.value.preset);
 };
@@ -16107,7 +17039,7 @@ var updateCommand = {
   usage: "finitemonkey update [--check] [--preset neutral|gabriel] [--bin <path>] [--yes]",
   status: "ready",
   options: { check: { type: "boolean" }, preset: { type: "string" }, bin: { type: "string" } },
-  run: (ctx, args) => Promise.resolve(runUpdate(ctx, args))
+  run: (ctx, args2) => Promise.resolve(runUpdate(ctx, args2))
 };
 
 // src/commands/version.ts
@@ -16136,18 +17068,20 @@ var REGISTRY = [
   taskDoneCommand,
   secretsScanCommand,
   secretsAcceptCommand,
+  policyFalsePositiveCommand,
   secretsIncidentCommand,
   proseCheckCommand,
   snapshotCommand,
   undoCommand,
   rescueCommand,
   mergeVerifyCommand,
+  appCheckCommand,
   versionCommand,
   helpCommand
 ];
 
 // src/i18n/lang-settings.ts
-import { join as join38 } from "node:path";
+import { join as join40 } from "node:path";
 var read3 = (runtime, path) => {
   const text6 = runtime.readText(toAbsolutePath(path));
   return text6.ok ? text6.value : void 0;
@@ -16162,14 +17096,14 @@ var languageIn = (text6) => {
   const value = parsed.ok && isRecord(parsed.value) ? parsed.value["language"] : void 0;
   return typeof value === "string" && value.trim() !== "" ? value : void 0;
 };
-var claudeDir = (runtime, env) => env["CLAUDE_CONFIG_DIR"] ?? join38(runtime.homeDir(), ".claude");
+var claudeDir = (runtime, env) => env["CLAUDE_CONFIG_DIR"] ?? join40(runtime.homeDir(), ".claude");
 var langSettings = (runtime, cwd, env, platform) => {
   const root = findGitRoot(cwd, runtime) ?? cwd;
-  const config = parseConfigYaml(read3(runtime, join38(root, CONFIG_FILE)) ?? "");
+  const config = parseConfigYaml(read3(runtime, join40(root, CONFIG_FILE)) ?? "");
   const claudeFiles = [
-    join38(root, ".claude", "settings.local.json"),
-    join38(root, ".claude", "settings.json"),
-    join38(claudeDir(runtime, env), "settings.json")
+    join40(root, ".claude", "settings.local.json"),
+    join40(root, ".claude", "settings.json"),
+    join40(claudeDir(runtime, env), "settings.json")
   ];
   return {
     config: configText(config, "lang"),
@@ -16220,9 +17154,9 @@ var failWith = (ctx, name, problem4) => ({
 });
 var invoke = (ctx, argv, spec2, registry) => {
   const name = commandName(spec2);
-  const args = strictArgs(argv, spec2);
-  if (!args.ok) return failWith(ctx, name, args.error);
-  return { name, execute: () => spec2.run(ctx, args.value, registry) };
+  const args2 = strictArgs(argv, spec2);
+  if (!args2.ok) return failWith(ctx, name, args2.error);
+  return { name, execute: () => spec2.run(ctx, args2.value, registry) };
 };
 var builtin = (registry, name) => registry.find((spec2) => commandName(spec2) === name);
 var dispatch = (ctx, argv, loose, registry) => {