heyspex 0.1.0 → 0.2.0

package/spexharness/src/gates/git-stash-gate.decide.mjs

@@ -0,0 +1,361 @@
+// spexharness/src/gates/git-stash-gate.decide.mjs
+//
+// Pure classifier functions relocated from scripts/claude-hooks/git-stash-gate.mjs
+// (HS-IQBF, per PORTING.md's "move the pure decision logic into the gate
+// module itself or a sibling pure module" — the original hook now delegates
+// to this file too, so ./git-stash-gate.mjs (the gate) is the only place this
+// logic lives; nothing here is a second copy that can drift). No stdin/
+// stdout/process.exit anywhere in this file. See ./git-stash-gate.mjs for the
+// gate's own orchestration (worktree bypass, sub-agent lock, protected-
+// action-intent) built on top of these primitives.
+
+import fs from 'node:fs';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+
+// `isWorktreePaths` moved out of scripts/claude-hooks/dev-server-task-reminder.mjs
+// into the shared ../dev-server-control.mjs when that hook became a thin shim
+// over its own engine gate (wave 6 of [[HS-AZ61-NYPR]]). Same function, same
+// behavior — only the import path moved.
+import { isWorktreePaths } from '../dev-server-control.mjs';
+import { checkSubagentLock } from '../../../scripts/lib/subagent-git-lock.mjs';
+import {
+  readAndValidateIntent,
+  consumeIntent,
+  buildNoIntentDenyMessage,
+  buildIntentAskMessage,
+  buildLockDenyMessage,
+} from '../../../scripts/claude-hooks/protected-action-intent.mjs';
+
+/** Shell out to git to answer "is this cwd a linked worktree (not the main checkout)?" */
+export function detectWorktreeIsolation(cwd = process.cwd()) {
+  try {
+    const dir = spawnSync('git', ['rev-parse', '--git-dir'], { cwd, encoding: 'utf8', timeout: 3000 });
+    const common = spawnSync('git', ['rev-parse', '--git-common-dir'], { cwd, encoding: 'utf8', timeout: 3000 });
+    if (dir.status !== 0 || common.status !== 0 || !dir.stdout?.trim() || !common.stdout?.trim()) return false;
+    return isWorktreePaths(path.resolve(cwd, dir.stdout.trim()), path.resolve(cwd, common.stdout.trim()));
+  } catch {
+    return false; // undetectable → stay gated (fail toward protection, not bypass)
+  }
+}
+
+// Read-only stash subcommands — inspecting a stash never discards anything.
+const READ_ONLY_SUBCOMMANDS = new Set(['list', 'show']);
+
+/**
+ * Find every `git stash <subcommand>` invocation in a (possibly compound)
+ * shell command, returning the lowercased subcommand for each (bare `git
+ * stash` with no subcommand normalizes to 'push', matching git's own default).
+ * Exported for tests.
+ */
+export function stashInvocations(command) {
+  const invocations = [];
+  const re = /\bgit\s+stash\b(?:\s+([A-Za-z-]+))?/gi;
+  let m;
+  while ((m = re.exec(command))) {
+    invocations.push((m[1] || 'push').toLowerCase());
+  }
+  return invocations;
+}
+
+/**
+ * Classify a tool call's git-stash content:
+ *   null         — no `git stash` invocation at all (not applicable)
+ *   'read-only'  — every invocation present is `list`/`show` (pass silently)
+ *   'gated'      — at least one invocation is a real stash action (ask, always)
+ * Exported for tests.
+ */
+export function classifyGitStash(toolName, toolInput) {
+  if (toolName !== 'Bash' && toolName !== 'PowerShell') return null;
+  const command = toolInput?.command;
+  if (typeof command !== 'string' || !command.trim()) return null;
+  const invocations = stashInvocations(command);
+  if (invocations.length === 0) return null;
+  const allReadOnly = invocations.every((sub) => READ_ONLY_SUBCOMMANDS.has(sub));
+  return allReadOnly ? 'read-only' : 'gated';
+}
+
+// ── Generalized destructive-verb gate (HS-IXEY) ─────────────────────────────
+// Every rule here mirrors stashInvocations/classifyGitStash's technique: a
+// whole-command regex scan (not anchored to the start of the string), so a
+// `cd X && ` chain never hides the verb. `segment` is the raw text following
+// `git <verb>` up to the next shell control operator (&&, ||, ;, |, newline)
+// or end of string — bounded the same way, so a LATER command in the same
+// chain never leaks into this verb's own flag check.
+const VERB_RULES = [
+  {
+    verb: 'reset',
+    pattern: 'reset',
+    // Scope: only --hard/--merge discard work; plain/--mixed/--soft reset does not.
+    classify: (seg) => (/(^|\s)--hard\b/.test(seg) || /(^|\s)--merge\b/.test(seg) ? 'gated' : null),
+  },
+  {
+    verb: 'checkout',
+    pattern: 'checkout',
+    classify: (seg) => {
+      if (/(^|\s)--\s+\S/.test(seg)) return 'gated'; // `checkout -- <path>` (incl. `checkout <ref> -- <path>`)
+      if (/^\s*\.(\s|$)/.test(seg)) return 'gated'; // bare `checkout .`
+      return null; // plain branch switch (`checkout <branch>`) is out of scope
+    },
+  },
+  {
+    verb: 'clean',
+    pattern: 'clean',
+    classify: (seg) => (/(^|\s)-[a-zA-Z]*f[a-zA-Z]*(\s|$)/.test(seg) || /--force\b/.test(seg) ? 'gated' : null),
+  },
+  {
+    verb: 'restore',
+    pattern: 'restore',
+    // Both the worktree form (default) and --staged rewrite state — always gated.
+    classify: () => 'gated',
+  },
+  {
+    verb: 'rebase',
+    pattern: 'rebase',
+    // Rewrites history on a shared branch unconditionally — always gated.
+    classify: () => 'gated',
+  },
+  {
+    verb: 'push',
+    pattern: 'push',
+    classify: (seg) => (/--force(-with-lease)?\b/.test(seg) || /(^|\s)-f(\s|$)/.test(seg) ? 'gated' : null),
+  },
+  {
+    verb: 'branch',
+    pattern: 'branch',
+    classify: (seg) =>
+      /(^|\s)-D\b/.test(seg) || (/--delete\b/.test(seg) && /--force\b/.test(seg)) ? 'gated' : null,
+  },
+  {
+    verb: 'commit',
+    pattern: 'commit',
+    classify: (seg) => (/--amend\b/.test(seg) ? 'gated' : null),
+  },
+];
+
+const VERB_RULES_BY_NAME = new Map(VERB_RULES.map((rule) => [rule.verb, rule]));
+
+/**
+ * Find every non-stash destructive-candidate invocation in a (possibly
+ * compound) shell command. Returns [{ verb, segment }] — `segment` is the raw
+ * text after `git <verb>` up to the next shell control operator or end of
+ * string. Exported for tests.
+ */
+export function destructiveVerbInvocations(command) {
+  const invocations = [];
+  for (const rule of VERB_RULES) {
+    const re = new RegExp(`\\bgit\\s+${rule.pattern}\\b([^;&|\\n]*)`, 'gi');
+    let m;
+    while ((m = re.exec(command))) {
+      invocations.push({ verb: rule.verb, segment: m[1] || '' });
+    }
+  }
+  return invocations;
+}
+
+/**
+ * Classify a tool call's non-stash destructive-verb content:
+ *   null    — no gated invocation of any of these verbs is present
+ *   array   — the list of verbs that matched a gated flag/form (non-empty)
+ * Exported for tests.
+ */
+export function classifyGitVerbs(toolName, toolInput) {
+  if (toolName !== 'Bash' && toolName !== 'PowerShell') return null;
+  const command = toolInput?.command;
+  if (typeof command !== 'string' || !command.trim()) return null;
+  const gated = destructiveVerbInvocations(command)
+    .map(({ verb, segment }) => (VERB_RULES_BY_NAME.get(verb).classify(segment) === 'gated' ? verb : null))
+    .filter(Boolean);
+  return gated.length > 0 ? gated : null;
+}
+
+/**
+ * Unified classifier across stash AND every other gated verb — what the gate
+ * driver AND the test file both call.
+ *   null         — nothing gated or read-only present (not applicable — pass)
+ *   'read-only'  — only read-only forms present (stash list/show)
+ *   'gated'      — at least one gated invocation of any verb — always ask
+ * Exported for tests.
+ */
+export function classifyGitDestructive(toolName, toolInput) {
+  const stashKind = classifyGitStash(toolName, toolInput);
+  const gatedVerbs = classifyGitVerbs(toolName, toolInput);
+  if (stashKind === 'gated' || gatedVerbs) return 'gated';
+  if (stashKind === 'read-only') return 'read-only';
+  return null;
+}
+
+// ── Restored below: runGitDestructiveGate and its private support ──────────
+// These were dropped (not carried forward) by the HS-IQBF relocation — the
+// engine port at ./git-stash-gate.mjs deliberately reconstructs only the
+// ORCHESTRATION using these primitives (see that file's own header) and does
+// NOT reproduce the original hook's stdout-emitting / audit-writing side
+// effects. scripts/claude-hooks/protected-action-intent.test.mjs still needs
+// the original side-effecting `runGitDestructiveGate` (it asserts on
+// captured stdout writes), so it is restored here verbatim from git history
+// (scripts/claude-hooks/git-stash-gate.mjs pre-cutover) — same behavior, same
+// stdout/audit side effects, no logic changes.
+
+function repoRoot() {
+  const fromEnv = process.env.CLAUDE_PROJECT_DIR?.trim();
+  if (fromEnv) return fromEnv.replace(/[\\/]+$/, '');
+  return path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..', '..');
+}
+
+/**
+ * NAMED PLACEHOLDER for the not-yet-built governing process
+ * (protected-shared-actions-gate.md "Future placeholder"). Deliberately
+ * inert: always returns null (no routing target), so the ask always goes to
+ * the user. Exported so a future patch (and a self-test proving it stays a
+ * no-op today) can target it directly.
+ */
+export function routeToGoverningProcess() {
+  return null; // NOT BUILT — see protected-shared-actions-gate.md. Ask always goes to the user.
+}
+
+function auditHistory(repoRootPath, record) {
+  try {
+    const dir = path.join(repoRootPath, '.heyspex');
+    fs.mkdirSync(dir, { recursive: true });
+    fs.appendFileSync(
+      path.join(dir, 'dev-server-history.jsonl'),
+      JSON.stringify({ timestamp: new Date().toISOString(), ...record }) + '\n',
+    );
+  } catch {
+    /* observability must never break the gate */
+  }
+}
+
+function emitAsk(reason) {
+  process.stdout.write(
+    JSON.stringify({
+      hookSpecificOutput: {
+        hookEventName: 'PreToolUse',
+        permissionDecision: 'ask',
+        permissionDecisionReason: reason,
+      },
+    }),
+  );
+}
+
+// HS-H8KI: deny is the one decision stronger than ask — used only to
+// ESCALATE (no valid intent, or an active sub-agent lock), never to soften
+// anything toward allow (specs/memory/decisions/protected-shared-tree-actions-assisted.md).
+function emitDeny(reason) {
+  process.stdout.write(
+    JSON.stringify({
+      hookSpecificOutput: {
+        hookEventName: 'PreToolUse',
+        permissionDecision: 'deny',
+        permissionDecisionReason: reason,
+      },
+    }),
+  );
+}
+
+const ASK_REASON =
+  'git stash (any form) is a PROTECTED action on a shared working tree ' +
+  '(protected-shared-actions-gate) — it sweeps EVERY uncommitted change in the tree, not just ' +
+  'yours, and has already caused a real incident (git-stash-sweeps-parallel-agent-work: 266 ' +
+  'modified + 173 untracked files swept, then 266 left with conflict markers on pop). This ' +
+  'ALWAYS requires explicit user permission in BOTH Assisted and Autonomous front — there is no ' +
+  'fleet-queue exception (a claim only proves exclusivity over one named resource; stash\'s blast ' +
+  'radius is not scoped to one resource). Approving IS the permission. Prefer a non-destructive ' +
+  'alternative first: `git worktree add ../verify-clean <commit>` to test a clean tree, ' +
+  '`git show <commit>:<path>` to read a prior revision, or `git diff` / `git log -p` to compare ' +
+  'without touching the tree.';
+
+const VERB_ASK_REASON =
+  'This git command is a PROTECTED action on a shared working tree (protected-shared-actions-gate) — ' +
+  'it can permanently discard uncommitted work or rewrite history other agents may be relying on (the ' +
+  'same class of action that wiped 36 files via an unguarded `git reset --hard` with no gate at all: ' +
+  'never-chain-cd-with-destructive-git-a). This ALWAYS requires explicit user permission in BOTH ' +
+  'Assisted and Autonomous front — approving IS the permission. Prefer a non-destructive alternative ' +
+  'first: `git worktree add ../verify-clean <commit>` to test a clean tree, `git show <commit>:<path>` ' +
+  'to read a prior revision, or `git diff` / `git log -p` to compare without touching the tree.';
+
+/**
+ * Run the gate for one PreToolUse payload. Returns true when this hook call
+ * was fully handled (an ask was emitted, or a read-only/bypass pass was
+ * logged) — false when nothing gated/read-only applies at all (not a
+ * destructive-git invocation), matching the runHardGate() convention in
+ * dev-server-task-reminder.mjs.
+ *
+ * HS-H8KI adds two checks BEFORE the always-ask floor, each one an
+ * escalation from ask to deny (never a softening toward allow — the locked
+ * decision protected-shared-tree-actions-assisted.md forbids that):
+ *   1. A sub-agent hard lock on this session (scripts/lib/subagent-git-lock.mjs)
+ *      → deny outright, no intent can override it.
+ *   2. No fresh, command-matched, correctly-shaped protected-action intent
+ *      on disk (scripts/claude-hooks/protected-action-intent.mjs) → deny
+ *      with instructions naming the file path and required fields.
+ * Only once both checks pass does the gate fall through to its prior
+ * behavior: emit an ask (now enriched with the intent's expected_breakage
+ * and peer list), and — because the intent is single-use — consume it so a
+ * later, different gated command can't ride the same written assessment.
+ */
+export function runGitDestructiveGate(
+  toolName,
+  toolInput,
+  { repoRootPath = repoRoot(), cwd = process.cwd(), sessionId = null } = {},
+) {
+  const kind = classifyGitDestructive(toolName, toolInput);
+  if (!kind) return false;
+
+  if (kind === 'read-only') {
+    auditHistory(repoRootPath, { event_kind: 'git_destructive.read_only_pass', tool: toolName });
+    return true; // explicitly exempt — never a silent "not applicable", always logged
+  }
+
+  if (detectWorktreeIsolation(cwd)) {
+    auditHistory(repoRootPath, { event_kind: 'git_destructive.worktree_bypass', tool: toolName });
+    return true;
+  }
+
+  // HS-H8KI check 1: an active sub-agent hard lock always wins — deny, full
+  // stop. No intent file, however fresh or well-shaped, can override it.
+  const lock = checkSubagentLock({ root: repoRootPath, sessionId });
+  if (lock) {
+    auditHistory(repoRootPath, { event_kind: 'git_destructive.lock_deny', tool: toolName, sessionId, lock });
+    emitDeny(buildLockDenyMessage(lock));
+    return true;
+  }
+
+  // HS-H8KI check 2: no valid, fresh, command-matched intent → deny with
+  // exactly what to write and where.
+  const command = toolInput?.command;
+  const intentResult = readAndValidateIntent({ root: repoRootPath, command });
+  if (!intentResult.ok) {
+    auditHistory(repoRootPath, {
+      event_kind: 'git_destructive.no_intent_deny',
+      tool: toolName,
+      reason: intentResult.reason,
+    });
+    emitDeny(buildNoIntentDenyMessage({ root: repoRootPath, reason: intentResult.reason }));
+    return true;
+  }
+
+  // Single-use — consume now so a later gated command (even a re-run of this
+  // exact one) can't ride the same written assessment.
+  consumeIntent(repoRootPath);
+
+  // Reserved for a future governing process — always null today (see
+  // routeToGoverningProcess's doc comment). Recorded in the audit line so a
+  // later activation is visible in history, not silently different.
+  const routed = routeToGoverningProcess();
+
+  // Stash keeps its own detailed incident-specific reason text; every other
+  // gated verb gets the generic one above. The intent's breakage assessment
+  // and peer list are always appended on top (AC2).
+  const baseReason = classifyGitStash(toolName, toolInput) === 'gated' ? ASK_REASON : VERB_ASK_REASON;
+
+  auditHistory(repoRootPath, {
+    event_kind: 'git_destructive.ask',
+    tool: toolName,
+    routedTo: routed,
+    claim_spec_id: intentResult.intent.claim_spec_id,
+  });
+  emitAsk(buildIntentAskMessage({ intent: intentResult.intent, baseReason }));
+  return true;
+}

package/spexharness/src/gates/git-stash-gate.mjs

@@ -0,0 +1,159 @@
+// spexharness/src/gates/git-stash-gate.mjs
+//
+// Engine port of scripts/claude-hooks/git-stash-gate.mjs — the PreToolUse
+// guard over every destructive git verb on a SHARED working tree (stash,
+// reset --hard, checkout -- <path>, clean -f, restore, rebase, push --force,
+// branch -D, commit --amend — see the original's own header for the full
+// incident history: HS-IXEY / HS-H8KI, epic HS-GG01-P3TJ). See ./PORTING.md
+// for the general recipe this follows.
+//
+// JUDGMENT CALL — read before touching this file: the original script does
+// NOT export a pure decision function. Its full decision (worktree bypass,
+// sub-agent lock, protected-action-intent check, ask/deny composition) lives
+// inside `runGitDestructiveGate`, which writes its verdict straight to
+// standard output as a side effect of deciding. PORTING.md's step-1 default
+// remedy is to extract a pure function INSIDE the original script — but this
+// porting task's own brief forbids touching anything under
+// scripts/claude-hooks/ in this pass ("shells come later"). So this module
+// reconstructs ONLY the orchestration (the order the checks run in, and
+// which one wins) using every decision PRIMITIVE the original already
+// exports or keeps in a separate pure module: classifyGitDestructive /
+// classifyGitStash / detectWorktreeIsolation (relocated to
+// ./git-stash-gate.decide.mjs, HS-IQBF — see that module's header),
+// checkSubagentLock (scripts/lib/subagent-git-lock.mjs), and
+// readAndValidateIntent / consumeIntent / buildNoIntentDenyMessage /
+// buildIntentAskMessage / buildLockDenyMessage
+// (scripts/claude-hooks/protected-action-intent.mjs). No regex/rule/
+// validation logic is re-derived anywhere in this file — every
+// classification and every deny/ask message body is imported, not
+// rewritten. The one piece of text this module owns that the original does
+// NOT export is the base "why this is protected" sentence — the original
+// keeps it in two private (non-exported) consts, ASK_REASON / VERB_ASK_REASON.
+// This module carries an equivalent-substance summary
+// (STASH_BASE_REASON / VERB_BASE_REASON below) instead of the byte-identical
+// string. That is safe because no golden fixture exercises the ask/rewrite
+// path for this gate (the recorded examples cover only deny-for-no-intent,
+// allow-for-read-only, and not-applicable) — the summary is asserted for
+// substance in this module's own test, never against a golden.
+//
+// Event mapping: PreToolUse (Bash|PowerShell) → before_tool, same as every
+// other gate here.
+// Decision mapping: not-applicable / read-only → allow; a sub-agent lock or
+// a missing/invalid protected-action intent → deny (the original's rule may
+// only ESCALATE toward deny, never soften toward allow — see
+// specs/memory/decisions/protected-shared-tree-actions-assisted.md); a
+// valid, fresh, command-matched intent → the original's `ask` outcome,
+// carried forward as a `rewrite` envelope (`{ ask: true, reason }`) — the
+// same mapping env-vault-guard.mjs's reference port uses for its own `ask`
+// case, since the engine has no synchronous-approval primitive either.
+//
+// Env hatch (unchanged): HEYSPEX_STASH_GATE_OFF=1.
+//
+// This gate deliberately does NOT write the original hook's audit trail
+// (.heyspex/dev-server-history.jsonl) — that writer is private to the
+// original hook, and audit logging is a hook-specific side effect, not part
+// of this module's decision contract. A future front that wants an audit
+// line for the engine's decision can write one at the call site.
+//
+// `ctx` contract (all optional):
+//   ctx.env       - env var overrides (falls back to process.env).
+//   ctx.cwd       - the tool call's working directory, used ONLY for the
+//                   worktree-isolation check (detectWorktreeIsolation).
+//                   Defaults to process.cwd().
+//   ctx.repoRoot  - where the protected-action-intent file and sub-agent
+//                   lock directory live. Defaults to CLAUDE_PROJECT_DIR, else
+//                   this repo's root — same resolution as the original's
+//                   own repoRoot().
+//   ctx.sessionId - session id for the sub-agent lock lookup. Defaults to
+//                   null (matches an unresolvable session in the original).
+
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+import {
+  classifyGitDestructive,
+  classifyGitStash,
+  detectWorktreeIsolation,
+} from './git-stash-gate.decide.mjs';
+import { checkSubagentLock } from '../../../scripts/lib/subagent-git-lock.mjs';
+import {
+  readAndValidateIntent,
+  consumeIntent,
+  buildNoIntentDenyMessage,
+  buildIntentAskMessage,
+  buildLockDenyMessage,
+} from '../../../scripts/claude-hooks/protected-action-intent.mjs';
+
+const HERE = path.dirname(fileURLToPath(import.meta.url));
+const REPO_ROOT = path.resolve(HERE, '..', '..', '..');
+
+// Equivalent-substance summaries of the original's private ASK_REASON /
+// VERB_ASK_REASON consts (see the judgment-call note above) — not asserted
+// against any golden fixture, only against this module's own test.
+const STASH_BASE_REASON =
+  "git stash (any form) is a PROTECTED action on a shared working tree (protected-shared-actions-gate) " +
+  "— it sweeps every uncommitted change in the tree, not just the caller's own, and has already caused " +
+  'a real incident. This always requires explicit user permission — approving IS the permission.';
+const VERB_BASE_REASON =
+  'This git command is a PROTECTED action on a shared working tree (protected-shared-actions-gate) — it ' +
+  'can permanently discard uncommitted work or rewrite history other agents may be relying on. This ' +
+  'always requires explicit user permission — approving IS the permission.';
+
+/** The git-destructive-verbs gate's id — unique across the built-in registry. */
+export const id = 'git-stash-gate';
+/** Runs pre-tool, same as its PreToolUse Claude Code hook registration. */
+export const event = 'before_tool';
+/** Caller-defined severity label; this gate can deny, so it is "block". */
+export const severity = 'block';
+
+/**
+ * @param {{ point: string, toolName?: string, toolInput?: Record<string, unknown> }} evt
+ * @param {{ cwd?: string, repoRoot?: string, sessionId?: string | null,
+ *            env?: Record<string, string | undefined> }} [ctx]
+ * @returns {{ decision: 'allow'|'deny'|'rewrite', reason?: string, rewrite?: object }}
+ */
+export function run(evt, ctx = {}) {
+  const env = ctx.env ?? process.env;
+  if (String(env.HEYSPEX_STASH_GATE_OFF ?? '') === '1') {
+    return { decision: 'allow' };
+  }
+
+  const toolName = evt?.toolName;
+  const toolInput = evt?.toolInput ?? {};
+  const kind = classifyGitDestructive(toolName, toolInput);
+  if (!kind || kind === 'read-only') {
+    return { decision: 'allow' };
+  }
+
+  const cwd = ctx.cwd ?? process.cwd();
+  if (detectWorktreeIsolation(cwd)) {
+    return { decision: 'allow' };
+  }
+
+  const root = ctx.repoRoot ?? process.env.CLAUDE_PROJECT_DIR ?? REPO_ROOT;
+
+  // HS-H8KI check 1: an active sub-agent hard lock always wins — deny, full
+  // stop. No intent file, however fresh or well-shaped, can override it.
+  const lock = checkSubagentLock({ root, sessionId: ctx.sessionId ?? null });
+  if (lock) {
+    return { decision: 'deny', reason: buildLockDenyMessage(lock) };
+  }
+
+  // HS-H8KI check 2: no valid, fresh, command-matched intent → deny with
+  // exactly what to write and where.
+  const command = toolInput?.command;
+  const intentResult = readAndValidateIntent({ root, command });
+  if (!intentResult.ok) {
+    return { decision: 'deny', reason: buildNoIntentDenyMessage({ root, reason: intentResult.reason }) };
+  }
+
+  // Single-use, same as the original — consume now so a later gated command
+  // (even a re-run of this exact one) can't ride the same written assessment.
+  consumeIntent(root);
+
+  const baseReason = classifyGitStash(toolName, toolInput) === 'gated' ? STASH_BASE_REASON : VERB_BASE_REASON;
+  const reason = buildIntentAskMessage({ intent: intentResult.intent, baseReason });
+  return { decision: 'rewrite', reason, rewrite: { ask: true, reason } };
+}
+
+export default { id, event, severity, run };