phasegate 0.212.0 → 0.229.0

package/CHANGELOG.md

@@ -7,6 +7,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Added
+
+- **WI-264 — `reconcile` prunes bundled skills that left the catalog** — `phasegate reconcile` (and its `update-skills` alias) now detects **manifest-managed** skills that are no longer in the current bundle catalog (`getBundledSkillsForSet("all")`) and prunes them: the on-disk skill directory is removed and the manifest entry is dropped. This closes the WI-256 orphan gap — the removed `implementation-planner` / `doc-freshness-checker` / `pointer-validator` directories are now cleaned up automatically on the next `reconcile --apply` (shared installs under `skills/`, personal installs under `.claude/skills/` and `.codex/skills/`). Pruning is **manifest-scoped**: user-owned skill directories that PhaseGate never recorded are never touched, and `.harness-version` is never pruned. `--dry-run` reports each prune (`action: "prune"`) without mutating disk or manifest, and the operation is idempotent.
+
 ### Changed
 
 - **WI-256 — skill catalog 30 → 29 (BREAKING for skill consumers)** — the bundled skill catalog is reshaped. **Removed** `implementation-planner`, `doc-freshness-checker`, and `pointer-validator`. **Added** `doc-health-checker` (core / Verification, `kind: advisory`) and `release-publisher` (guidance / Operations, `kind: advisory`). Net advisory count 7 → 8, lifecycle 23 → 21, total 30 → 29. Both catalog sources (`skill-deployer.ts` `SKILL_CATEGORIES`, `bundled-skill-selection.ts`) and all count phrases / category headings were updated in the same batch.
@@ -14,18 +18,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   - Doc-quality checks are now driven by **`doc-health-checker`**, which wraps the correct `p2:`-prefixed CLI commands: `npx phasegate p2:check-freshness` (freshness / code-design drift, L4-004) and `npx phasegate p2:validate-pointers` (broken file-path pointers, L4-005; supported flags are `--pattern` / `--include-urls` / `--format` — there is no auto-fix flag). The removed skills documented the wrong unprefixed command names (`phasegate check-freshness` / `phasegate validate-pointers`); those are corrected here.
   - **Note**: `doc-freshness-checker` and `pointer-validator` also exist as **L4 validator IDs** (config presets, `validator-id.ts`, `ci-governance`). Those are a different concept and are **not** affected by this change — only the `skills/` directories were removed.
 
-#### Migration (manual removal required in consumer repos)
-
-`reconcile` does **not** prune skills that have left the bundle, so the three removed skill directories will remain as orphans in already-installed projects. Remove them manually:
-
-```bash
-rm -r skills/implementation-planner skills/doc-freshness-checker skills/pointer-validator
-# If personal-mode per-agent copies exist:
-rm -r .claude/skills/{implementation-planner,doc-freshness-checker,pointer-validator}
-rm -r .codex/skills/{implementation-planner,doc-freshness-checker,pointer-validator}
-```
+#### Migration (consumer repos)
 
-A permanent `reconcile`-based prune is deferred to a follow-up WI.
+As of WI-264 (see **Added** above), `reconcile` prunes the three removed skill directories automatically — run `phasegate reconcile --apply` (or the `update-skills` alias) in each already-installed project and the orphaned `implementation-planner` / `doc-freshness-checker` / `pointer-validator` directories are removed from `skills/` (and, for personal installs, `.claude/skills/` / `.codex/skills/`) along with their manifest entries. Use `--dry-run` first to preview. Manual `rm` is no longer required.
 
 ## [0.171.0] - 2026-07-05
 

package/docs/ADR/001-l1-biome-editor-time-enforcement.md

@@ -26,6 +26,8 @@ Rust製 Biome の AST 解析を用いて、L1（Editor-Time）で以下の8ル
 | no-comment-flood | L1-007 | 過剰なコメント |
 | no-code-duplication | L1-008 | 構造的に重複するコードブロック |
 
+> 注記（WI-274, 2026-07-16）: 上表の L1-006〜L1-008 のルール名↔コード対応は当時の記述であり、現行の canonical と異なる。現行の正しい対応は `L1-006`=`no-code-duplication` / `L1-007`=`no-ghost-file` / `L1-008`=`no-comment-flood`（WI-265 で是正済み。真実の源は `biome-ast-engine` の `rule-definition-registry.ts`）。本文は歴史記録として保存する。
+
 ## Consequences
 
 - エージェントのプロンプト遵守度に品質が依存しない

package/docs/ADR/015-architecture-preset.md

@@ -133,6 +133,8 @@ v0.86.0（ADR-014 適用）以降、`ALLOWED_DEPENDENCIES.presentation` に `'do
 | L1-007 no-comment-flood | 有効維持 |
 | L1-008 no-code-duplication | 有効維持 |
 
+> 注記（WI-274, 2026-07-16）: 上表の L1-006〜L1-008 のルール名↔コード対応は当時の記述であり、現行の canonical と異なる。現行の正しい対応は `L1-006`=`no-code-duplication` / `L1-007`=`no-ghost-file` / `L1-008`=`no-comment-flood`（WI-265 で是正済み。真実の源は `biome-ast-engine` の `rule-definition-registry.ts`）。`flat` preset で「有効維持」となる 3 ルール（重複/ghost/コメント過多）という判断自体は不変で、コード表記のみが当時 drift していた。本文は歴史記録として保存する。
+
 ### メタデータタグの可変化
 
 `@layer` / `@unit` というタグ名自体も `metadataTags` で差し替え可能とする。これにより、社内規約で `@tier` / `@module` 等を使う PJ にも対応できる。

package/docs/ADR/030-injection-threat-model-and-trust-root.md

@@ -69,7 +69,7 @@ L0–L2 は **fast-path** として正直に位置づける。fast-path の価
 
 指示を搭載するファイル群の SHA-256 を `phasegate.integrity.json` に pin する。対象:
 
-- SKILL.md × 30
+- SKILL.md × 29
 - `CLAUDE.md` / `AGENTS.md` テンプレート
 - hook 定義
 - `deny-check.sh`

package/docs/guide/hooks-integration.md

@@ -155,13 +155,64 @@ The permitted set lives in `GIT_ALLOWED_SUBCOMMANDS` in `.claude/scripts/deny-ch
 ```
 status log show diff add commit tag restore rev-parse rev-list
 merge-base branch worktree fetch grep cat-file ls-files ls-tree
-ls-remote config init remote describe blame shortlog
-symbolic-ref for-each-ref name-rev check-ignore check-attr
+ls-remote init remote describe blame shortlog
+for-each-ref name-rev check-ignore check-attr
 stripspace var help version whatchanged push
 ```
 
 History- and working-tree-mutating subcommands are intentionally **absent** so they fail closed, including: `checkout`, `switch`, `reset`, `rebase`, `merge`, `cherry-pick`, `revert`, `stash`, `clean`, `update-ref`, `reflog`, `filter-branch`, `replace`, and `am`.
 
+### `symbolic-ref`: read allowed, write denied (WI-269)
+
+<!-- @work-item-id WI-269 -->
+
+`symbolic-ref` is **not** on the plain allowlist above; it is adjudicated by a
+dedicated guard (`check_symbolic_ref`), because it has both a read form and a
+state-mutating write form:
+
+- **Read (allowed)** — reports the ref that HEAD points at without changing
+  anything: `git symbolic-ref HEAD`, `git symbolic-ref --short HEAD`,
+  `git symbolic-ref -q HEAD`.
+- **Write (denied)** — re-points HEAD, which is **checkout-equivalent HEAD
+  mutation**: `git symbolic-ref HEAD refs/heads/<branch>` (a second positional
+  argument), `git symbolic-ref -d HEAD` / `--delete` (removes the symbolic ref),
+  and `-m <reason>` write variants.
+
+The guard tolerates the same global-flag stuffing as the allowlist extractor, so
+`git -C <path> symbolic-ref HEAD refs/heads/x` is still denied, and write forms
+smuggled behind chaining/substitution operators are caught by per-segment
+inspection. This closes the same class of hole as the `git switch` leak that
+motivated the allowlist (WI-253): before this guard, `symbolic-ref` sat on the
+allowlist and its write form re-pointed HEAD exactly like a `checkout`.
+
+### `config`: read allowed, write denied (WI-271)
+
+<!-- @work-item-id WI-271 -->
+
+`config` is likewise **not** on the plain allowlist; it is adjudicated by a
+dedicated guard (`check_git_config`). The write form is strictly worse than the
+`symbolic-ref` hole it follows: `git config core.hooksPath <dir>` re-points the
+hook path itself, which would disable the **entire L0 defence layer** (this very
+hook included).
+
+- **Read (allowed)** — `git config --get <key>`, `--get-all`, `--get-regexp`,
+  `--get-urlmatch`, `--list` / `-l`, and the bare value read
+  `git config <key>` (one positional argument, no value). Read forms combined
+  with scope flags are legitimate and pass: `git config --global --list`,
+  `git config --local --get user.name`.
+- **Write (denied)** — `git config <key> <value>` (two positional arguments),
+  `--unset` / `--unset-all`, `--add`, `--replace-all`, `--edit` / `-e`,
+  `--remove-section`, `--rename-section`, and the new-style verb subcommands
+  (`git config set|unset|edit|rename-section|remove-section ...`, git >= 2.46).
+
+Ambiguous invocations fail closed: anything that is not a recognized read form
+and carries two or more positionals is denied, so the new-style
+`git config get <key>` spelling is (conservatively) denied — use the flag form
+`git config --get <key>` instead. The guard tolerates the same global-flag
+stuffing as the allowlist extractor (`git -C <path> config <key> <value>` is
+still denied) and chained/substituted write forms are caught by per-segment
+inspection.
+
 ### How the subcommand is extracted
 
 The check tolerates global options placed before the subcommand, so evasion via flag stuffing does not bypass it. All of the following resolve to their real subcommand (`merge`, denied):

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "phasegate",
-  "version": "0.212.0",
+  "version": "0.229.0",
   "packageManager": "pnpm@10.30.1",
   "description": "Phasegate — AI-agnostic quality defense toolkit. Enforces structural integrity between design intent and code.",
   "license": "MIT",

package/scripts/harness/biome-ast-engine/application/mappers/build-harness-error-payload-output-mapper.ts

@@ -24,9 +24,9 @@ const RULE_CODE_BY_NAME: Readonly<Record<string, string>> = Object.freeze({
   'no-layer-violation': 'L1-003',
   'enforce-folder-structure': 'L1-004',
   'no-any-abuse': 'L1-005',
-  'no-ghost-file': 'L1-006',
-  'no-comment-flood': 'L1-007',
-  'no-code-duplication': 'L1-008',
+  'no-code-duplication': 'L1-006',
+  'no-ghost-file': 'L1-007',
+  'no-comment-flood': 'L1-008',
 });
 
 const toHarnessErrorPayloadItem = (

package/scripts/harness/biome-ast-engine/infrastructure/mappers/rule-violation-code-mapper.ts

@@ -11,9 +11,9 @@ const RULE_TO_CODE: Readonly<Record<RuleNameValue, string>> = {
   'no-layer-violation': 'L1-003',
   'enforce-folder-structure': 'L1-004',
   'no-any-abuse': 'L1-005',
-  'no-ghost-file': 'L1-006',
-  'no-comment-flood': 'L1-007',
-  'no-code-duplication': 'L1-008',
+  'no-code-duplication': 'L1-006',
+  'no-ghost-file': 'L1-007',
+  'no-comment-flood': 'L1-008',
 };
 
 export class UnknownRuleCodeMappingError extends Error {

package/scripts/harness/biome-ast-engine/presentation/cli/harness-lint-command-handler.ts

@@ -104,13 +104,15 @@ export class HarnessLintCommandHandler {
     if (errorPayload.errors.length === 0) {
       lines.push('No violations found');
     } else {
-      lines.push(`${errorPayload.errors.length} violation(s):`);
-      const shown = errorPayload.errors.slice(0, 3);
+      const total = errorPayload.errors.length;
+      lines.push(`${total} violation(s):`);
+      const displayLimit = 3;
+      const shown = errorPayload.errors.slice(0, displayLimit);
       for (const e of shown) {
         lines.push(`  [${e.severity}] ${e.code}: ${e.message}`);
       }
-      if (errorPayload.errors.length > 3) {
-        lines.push(`  ... and ${errorPayload.errors.length - 3} more`);
+      if (total > displayLimit) {
+        lines.push(`  ... and ${total - displayLimit} more (shown ${shown.length} of ${total})`);
       }
     }
 

package/scripts/harness/config-foundation/application/mappers/validator-system-config-mapper.ts

@@ -6,6 +6,7 @@
  * @work-item-id WI-212
  * @work-item-id WI-258
  * @work-item-id WI-259
+ * @work-item-id WI-268
  */
 import type { HarnessConfigV2 } from "../../domain/harness-config.js";
 
@@ -21,6 +22,7 @@ export function toValidatorSystemConfig(resolvedConfig: HarnessConfigV2 | undefi
       nyquist: "L3-004",
       "ac-bound-coverage": "L3-005",
       "injection-scan": "L3-006",
+      "coverage-attestation-verification": "L3-007",
     },
     /^L3-\d{3}$/,
   );
@@ -63,10 +65,15 @@ export function toValidatorSystemConfig(resolvedConfig: HarnessConfigV2 | undefi
       L3: {
         enabled: resolvedConfig.layers.L3.enabled,
         // WI-259 / ADR-030 §Decision.3.④: L3-006 (injection-scan) は advisory default-ON。
-        // fallback 判定の後に force-include し、normalize 結果でも fallback でも常に含める（warning-only ゆえ安全）。
+        // WI-268 / ADR-030 §Decision.1・§Decision.3.② 第2段: L3-007 (coverage-attestation-verification)
+        // は fail-closed default-ON。いずれも fallback 判定の後に force-include し、normalize 結果でも
+        // fallback でも常に含める（L3-007 は fail-closed だが現 corpus は実参照 0 件ゆえ緑）。
         validators: includeValidator(
-          l3Validators.length > 0 ? l3Validators : ["L3-001", "L3-002", "L3-003", "L3-004"],
-          "L3-006",
+          includeValidator(
+            l3Validators.length > 0 ? l3Validators : ["L3-001", "L3-002", "L3-003", "L3-004"],
+            "L3-006",
+          ),
+          "L3-007",
         ),
         coverageThreshold: resolvedConfig.layers.L3.coverageThreshold,
         requirementMatrixPath: resolvedConfig.layers.L3.requirementMatrixPath,

package/scripts/harness/harness-error/infrastructure/registry/l1-error-definitions.ts

@@ -67,24 +67,24 @@ export const L1_ERROR_DEFINITIONS = Object.freeze([
   }),
   createDefinition({
     code: 'L1-006',
-    title: '参照されないファイルが残っている',
+    title: '重複コードが検出された',
     category: 'architecture',
     ownerValidatorId: 'architecture',
-    defaultFixExample: 'export const actual = "shared";',
+    defaultFixExample:
+      'function buildValue(): string { return "shared"; }\nconst actual = buildValue();',
   }),
   createDefinition({
     code: 'L1-007',
-    title: 'コメント量が過剰である',
-    category: 'quality',
+    title: '参照されないファイルが残っている',
+    category: 'architecture',
     ownerValidatorId: 'architecture',
-    defaultFixExample: 'const actual = "keep comments concise";',
+    defaultFixExample: 'export const actual = "shared";',
   }),
   createDefinition({
     code: 'L1-008',
-    title: '重複コードが検出された',
-    category: 'architecture',
+    title: 'コメント量が過剰である',
+    category: 'quality',
     ownerValidatorId: 'architecture',
-    defaultFixExample:
-      'function buildValue(): string { return "shared"; }\nconst actual = buildValue();',
+    defaultFixExample: 'const actual = "keep comments concise";',
   }),
 ]);

package/scripts/harness/installation/application/usecases/run-reconcile.ts

@@ -6,6 +6,7 @@
 // @work-item-id WI-210
 // @work-item-id WI-216
 // @work-item-id WI-219
+// @work-item-id WI-264
 
 import { access, chmod, copyFile, lstat, mkdir, readFile, readlink, readdir, rm, symlink, writeFile } from "node:fs/promises";
 import { dirname, join, relative, resolve } from "node:path";
@@ -18,7 +19,7 @@ import type { HashCalculatorPort } from "../ports/hash-calculator-port.js";
 import type { ManifestRepositoryPort } from "../ports/manifest-repository-port.js";
 import type { ModelDelegationPort } from "../ports/model-delegation-port.js";
 
-type ReconcileAction = "missing-manifest" | "update" | "add" | "link" | "skip" | "refuse";
+type ReconcileAction = "missing-manifest" | "update" | "add" | "link" | "skip" | "refuse" | "prune";
 type StrategyType = "json" | "shell" | "yaml-add" | "package-json" | "markdown-managed" | "copy-dir" | "symlink" | "unknown";
 
 export interface ReconcilePlanItem {
@@ -62,6 +63,8 @@ const SHELL_END = "# === phasegate managed (END) ===";
 const MARKDOWN_BEGIN = "<!-- phasegate:managed-section:start -->";
 const MARKDOWN_END = "<!-- phasegate:managed-section:end -->";
 const SHARED_SKILLS_VERSION_PATH = "skills/.harness-version";
+const HARNESS_VERSION_BASENAME = ".harness-version";
+const SKILL_ROOT_PREFIXES = ["skills", ".claude/skills", ".codex/skills"] as const;
 
 function isRecord(value: unknown): value is Record<string, unknown> {
   return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -302,6 +305,7 @@ export class RunReconcileUseCase {
     const outcomes: Array<{
       readonly item: ReconcilePlanItem;
       readonly needsBackup: boolean;
+      readonly prune?: boolean;
       readonly apply: () => Promise<string | null>;
     }> = [];
 
@@ -346,12 +350,23 @@ export class RunReconcileUseCase {
       }
     }
 
+    for (const outcome of this.planOrphanSkills(input, manifest)) {
+      outcomes.push(outcome);
+      plan.push(outcome.item);
+    }
+
     if (!input.apply || refused.length > 0) {
       return { plan, refused, changed, backupDir: null };
     }
 
     for (const outcome of outcomes) {
       if (!outcome.item.changed) continue;
+      if (outcome.prune === true) {
+        await outcome.apply();
+        nextManifest = nextManifest.removeEntry(outcome.item.path);
+        changed.push(outcome.item);
+        continue;
+      }
       if (outcome.needsBackup) {
         backupDir ??= join(input.projectRoot, ".phasegate", "backups", backupStamp);
         await this.backup(input.projectRoot, outcome.item.path, backupDir);
@@ -616,6 +631,59 @@ export class RunReconcileUseCase {
     };
   }
 
+  private planOrphanSkills(input: RunReconcileInput, manifest: DeploymentManifest): Array<{
+    readonly item: ReconcilePlanItem;
+    readonly needsBackup: boolean;
+    readonly prune: boolean;
+    readonly apply: () => Promise<string | null>;
+  }> {
+    const allowed = new Set(getBundledSkillsForSet("all"));
+    const outcomes: Array<{
+      readonly item: ReconcilePlanItem;
+      readonly needsBackup: boolean;
+      readonly prune: boolean;
+      readonly apply: () => Promise<string | null>;
+    }> = [];
+    for (const entry of manifest.entries) {
+      if (entry.mode !== "created") continue;
+      const skillName = this.orphanSkillName(entry.path, allowed);
+      if (skillName === null) continue;
+      const absolutePath = this.resolveProjectPath(input.projectRoot, entry.path);
+      outcomes.push({
+        item: this.item(
+          entry.path,
+          "prune",
+          "mechanical",
+          "copy-dir",
+          true,
+          `${entry.path}: prune orphan skill (not in current bundle)`,
+          "- skill directory",
+          null,
+        ),
+        needsBackup: false,
+        prune: true,
+        apply: async () => {
+          await rm(absolutePath, { recursive: true, force: true });
+          return null;
+        },
+      });
+    }
+    return outcomes;
+  }
+
+  private orphanSkillName(entryPath: string, allowed: ReadonlySet<string>): string | null {
+    for (const prefix of SKILL_ROOT_PREFIXES) {
+      const marker = `${prefix}/`;
+      if (!entryPath.startsWith(marker)) continue;
+      const remainder = entryPath.slice(marker.length);
+      if (remainder.length === 0 || remainder.includes("/")) return null;
+      if (remainder === HARNESS_VERSION_BASENAME) return null;
+      if (allowed.has(remainder)) return null;
+      return remainder;
+    }
+    return null;
+  }
+
   private createdEntry(path: string, hashInput: string): DeploymentEntry {
     return DeploymentEntry.create({
       path,

package/scripts/harness/validator-system/application/use-cases/run-l3-validators-usecase.ts

@@ -8,10 +8,12 @@
 
 import type { AcBoundCoveragePolicyPort } from "../../domain/ports/ac-bound-coverage-policy-port.js";
 import type { AcCoveragePolicyPort } from "../../domain/ports/ac-coverage-policy-port.js";
+import type { CoverageAttestationVerificationPolicyPort } from "../../domain/ports/coverage-attestation-verification-policy-port.js";
 import type { InjectionScanPolicyPort } from "../../domain/ports/injection-scan-policy-port.js";
 import type { PerformanceScannerPort } from "../../domain/ports/performance-scanner-port.js";
 import type { SecurityPatternScannerPort } from "../../domain/ports/security-pattern-scanner-port.js";
 import type { ValidatorConfigPort } from "../../domain/ports/validator-config-port.js";
+import { CoverageAttestationVerificationService } from "../../domain/services/coverage-attestation-verification-service.js";
 import { InjectionPatternScanService } from "../../domain/services/injection-pattern-scan-service.js";
 import {
   ValidatorExecutionError,
@@ -50,6 +52,8 @@ export interface RunL3ValidatorsUseCaseDeps {
   performanceScannerPort?: PerformanceScannerPort;
   /** WI-259 / ADR-030 §Decision.3.④: L3-006 (injection-scan, advisory) 用ポート。 */
   injectionScanPolicyPort?: InjectionScanPolicyPort;
+  /** WI-268 / ADR-030 §Decision.1・§Decision.3.② 第2段: L3-007 (coverage-attestation-verification, fail-closed) 用ポート。 */
+  coverageAttestationVerificationPolicyPort?: CoverageAttestationVerificationPolicyPort;
   /** L3-005 のスコープ対象 story-id（config layers.L3.acBoundStories 由来。既定 []）。 */
   acBoundStories?: readonly string[];
 }
@@ -65,9 +69,11 @@ export class RunL3ValidatorsUseCase {
   private readonly securityScannerPort?: SecurityPatternScannerPort;
   private readonly performanceScannerPort?: PerformanceScannerPort;
   private readonly injectionScanPolicyPort?: InjectionScanPolicyPort;
+  private readonly coverageAttestationVerificationPolicyPort?: CoverageAttestationVerificationPolicyPort;
   private readonly acBoundStories: readonly string[];
   private readonly languageCapabilityService = new ValidatorLanguageCapabilityService();
   private readonly injectionScanService = new InjectionPatternScanService();
+  private readonly coverageAttestationVerificationService = new CoverageAttestationVerificationService();
 
   constructor(deps: RunL3ValidatorsUseCaseDeps) {
     this.registry = deps.validatorRegistry;
@@ -80,6 +86,7 @@ export class RunL3ValidatorsUseCase {
     this.securityScannerPort = deps.securityScannerPort;
     this.performanceScannerPort = deps.performanceScannerPort;
     this.injectionScanPolicyPort = deps.injectionScanPolicyPort;
+    this.coverageAttestationVerificationPolicyPort = deps.coverageAttestationVerificationPolicyPort;
     this.acBoundStories = deps.acBoundStories ?? [];
   }
 
@@ -254,6 +261,50 @@ export class RunL3ValidatorsUseCase {
       }
     }
 
+    // WI-268 / ADR-030 §Decision.1・§Decision.3.② 第2段: L3-007 coverage-attestation-verification。
+    // coverage_report の @attestation 参照を requirement-test-matrix に突合し、解決不能な参照
+    // （空手形の attestation）を fail-closed の error として遮断する（L2-016 の authoritative 相棒）。
+    // 参照ありで matrix を読めなければ fail-closed で FAIL。default-OFF/skip 時は override しない。
+    if (this.coverageAttestationVerificationPolicyPort) {
+      const l3007Result = overrideMap.get("L3-007");
+      if (l3007Result && !l3007Result.skipped) {
+        const l3007Id = ValidatorId.create("L3-007");
+        const collected = await this.coverageAttestationVerificationPolicyPort.collect();
+        if (collected.matrixError !== null) {
+          overrideMap.set(
+            "L3-007",
+            ValidationResult.fail(
+              l3007Id,
+              [
+                {
+                  code: { value: "L3-007", toString: () => "L3-007" },
+                  severity: { value: "error", toString: () => "error" },
+                  message: collected.matrixError,
+                  suggestion:
+                    ".harness/requirement-test-matrix.json を生成してください（phasegate:generate-matrix）。パスは config の layers.L3.requirementMatrixPath で変更できます。",
+                },
+              ],
+              0,
+            ),
+          );
+        } else {
+          const report = this.coverageAttestationVerificationService.verify(collected.references, collected.evidence);
+          if (report.hasFindings()) {
+            const errors: HarnessErrorLike[] = report.findings.map((finding) => ({
+              code: { value: "L3-007", toString: () => "L3-007" },
+              severity: { value: "error", toString: () => "error" },
+              message: finding.message,
+              suggestion: finding.suggestion,
+              sourcePath: finding.sourcePath,
+            }));
+            overrideMap.set("L3-007", ValidationResult.fail(l3007Id, errors, 0));
+          } else {
+            overrideMap.set("L3-007", ValidationResult.pass(l3007Id, 0));
+          }
+        }
+      }
+    }
+
     const finalResults = definitions.map(
       (definition) => overrideMap.get(definition.validatorId.value) ?? ValidationResult.skip(definition.validatorId),
     );

package/scripts/harness/validator-system/composition-root.ts

@@ -38,6 +38,7 @@ import { E2eTestFileRegistryAdapter } from "./infrastructure/adapters/e2e-test-f
 import { FileSystemArchitectureSemanticSourceAdapter } from "./infrastructure/adapters/file-system-architecture-semantic-source-adapter.js";
 import { FileSystemContractTraceabilityPolicyAdapter } from "./infrastructure/adapters/file-system-contract-traceability-policy-adapter.js";
 import { FileSystemCoverageAttestationGatingAdapter } from "./infrastructure/adapters/file-system-coverage-attestation-gating-adapter.js";
+import { FileSystemCoverageAttestationVerificationAdapter } from "./infrastructure/adapters/file-system-coverage-attestation-verification-adapter.js";
 import { FileSystemInjectionScanAdapter } from "./infrastructure/adapters/file-system-injection-scan-adapter.js";
 import { FileSystemSecurityPatternScannerAdapter } from "./infrastructure/adapters/file-system-security-pattern-scanner-adapter.js";
 import { FileSystemSkillCatalogDriftAdapter } from "./infrastructure/adapters/file-system-skill-catalog-drift-adapter.js";
@@ -65,7 +66,7 @@ const DEFAULT_CONFIG = {
     L2: { enabled: true, validators: ["L2-001", "L2-002", "L2-003", "L2-013", "L2-014", "L2-015", "L2-016"] },
     L3: {
       enabled: true,
-      validators: ["L3-001", "L3-002", "L3-003", "L3-004", "L3-006"],
+      validators: ["L3-001", "L3-002", "L3-003", "L3-004", "L3-006", "L3-007"],
       coverageThreshold: 90,
       bundleSizeLimit: 512000,
       requirementMatrixPath: ".harness/requirement-test-matrix.json",
@@ -142,6 +143,9 @@ export function buildDefaultRegistry(): ValidatorRegistry {
     createDef("L3-005", "L3", "always", "AcBoundCoveragePolicyPort"),
     // WI-259 / ADR-030 §Decision.3.④: L3-006 (injection-scan) は advisory (warning-only, default-ON)。
     createDef("L3-006", "L3", "always", "InjectionScanPolicyPort"),
+    // WI-268 / ADR-030 §Decision.1・§Decision.3.② 第2段: L3-007 (coverage-attestation-verification)
+    // は fail-closed / default-ON。L2-016 の authoritative 相棒。
+    createDef("L3-007", "L3", "always", "CoverageAttestationVerificationPolicyPort"),
     createDef("L4-001", "L4", "always"),
     createDef("L4-002", "L4", "always"),
     createDef("L4-003", "L4", "strictOnly"),
@@ -201,6 +205,13 @@ export function createValidatorSystemModule(config?: object): ValidatorSystemMod
   // 指示搭載ファイル群（skills/**​/SKILL.md / CLAUDE.md / AGENTS.md / agent-context / .claude/settings.json）を
   // cwd 起点で走査する（targetPaths 非依存）。
   const injectionScanPolicyPort = new FileSystemInjectionScanAdapter(process.cwd());
+  // WI-268 / ADR-030 §Decision.1・§Decision.3.② 第2段: L3-007 (coverage-attestation-verification) 用アダプタ。
+  // coverage_report の @attestation 参照を requirement-test-matrix に突合する（fail-closed）。
+  const coverageAttestationVerificationPolicyPort = new FileSystemCoverageAttestationVerificationAdapter(
+    process.cwd(),
+    (configData.layers?.L3 as { requirementMatrixPath?: string } | undefined)?.requirementMatrixPath ??
+      ".harness/requirement-test-matrix.json",
+  );
 
   const cwd = process.cwd();
   const designDocsRoot = configData.paths?.designDocs ?? "docs/product/construction";
@@ -255,6 +266,7 @@ export function createValidatorSystemModule(config?: object): ValidatorSystemMod
     securityScannerPort,
     performanceScannerPort,
     injectionScanPolicyPort,
+    coverageAttestationVerificationPolicyPort,
     acBoundStories,
   });
 

package/scripts/harness/validator-system/domain/ports/coverage-attestation-verification-policy-port.ts

@@ -0,0 +1,30 @@
+// @unit validator-system
+// @layer domain
+// @work-item-id WI-268
+
+import type {
+  AttestationReference,
+  AttestationScopeEvidence,
+} from "../value-objects/attestation-verification-report.js";
+
+/**
+ * WI-268 / ADR-030 §Decision.1・§Decision.3.②（第2段） — L3-007 の走査・解決結果供給ポート。
+ *
+ * 参照走査（ungated-legacy 免除込み）と matrix 由来の解決可能スコープ解決は infrastructure が担う
+ * （cwd 起点・targetPaths 非依存の corpus 走査）。
+ */
+export interface CoverageAttestationVerificationCollectResult {
+  /** ungated-legacy を除いた coverage_report から抽出した attestation 参照。 */
+  readonly references: readonly AttestationReference[];
+  /** matrix 由来の解決可能スコープ。references が空のときは空集合でよい（matrix 未読）。 */
+  readonly evidence: AttestationScopeEvidence;
+  /**
+   * 参照ありで matrix を読めなかった fail-closed シグナル。
+   * null なら matrix 読み込みは問題なし（または参照 0 件で matrix 未読）。
+   */
+  readonly matrixError: string | null;
+}
+
+export interface CoverageAttestationVerificationPolicyPort {
+  collect(): Promise<CoverageAttestationVerificationCollectResult>;
+}

package/scripts/harness/validator-system/domain/services/coverage-attestation-verification-service.ts

@@ -0,0 +1,45 @@
+// @unit validator-system
+// @layer domain
+// @work-item-id WI-268
+
+/**
+ * WI-268 / ADR-030 §Decision.1・§Decision.3.②（第2段） — coverage-attestation-verification
+ * (L3-007) の突合ドメインサービス。
+ *
+ * INV-A: 各 reference の id が evidence.resolvableScopeIds に含まれなければ error finding を生成
+ *        （fail-closed。空手形の attestation を遮断）。
+ * INV-B: references が空なら report は空（検査対象なし → pass）。
+ * INV-C: 生成 finding は必ず severity='error'（advisory ではなく blocking tier）。
+ */
+
+import {
+  type AttestationReference,
+  type AttestationScopeEvidence,
+  type AttestationVerificationFinding,
+  AttestationVerificationReport,
+} from "../value-objects/attestation-verification-report.js";
+
+export class CoverageAttestationVerificationService {
+  verify(
+    references: readonly AttestationReference[],
+    evidence: AttestationScopeEvidence,
+  ): AttestationVerificationReport {
+    const findings: AttestationVerificationFinding[] = [];
+
+    for (const reference of references) {
+      // INV-A: matrix 由来の解決可能スコープに存在しない参照は fail-closed の error。
+      if (!evidence.resolvableScopeIds.has(reference.id)) {
+        findings.push({
+          severity: "error",
+          sourcePath: reference.sourcePath,
+          lineNumber: reference.lineNumber,
+          message: `${reference.sourcePath}:${reference.lineNumber} の @attestation "${reference.id}" は requirement-test-matrix 上のテスト参照に解決できません（空手形 attestation は fail-closed）。`,
+          suggestion:
+            "@attestation <id> の id を、matrix 上に存在し testReferences を 1 件以上持つ story-id にしてください（phasegate:generate-matrix で最新化）。返済前なら <!-- @coverage-gating: ungated-legacy --> マーカーで免除（負債可視化）すること。",
+        });
+      }
+    }
+
+    return AttestationVerificationReport.create(findings);
+  }
+}

package/scripts/harness/validator-system/domain/value-objects/attestation-verification-report.ts

@@ -0,0 +1,59 @@
+// @unit validator-system
+// @layer domain
+// @work-item-id WI-268
+
+/**
+ * WI-268 / ADR-030 §Decision.1・§Decision.3.②（第2段） — coverage_report の attestation
+ * 参照を requirement-test-matrix に対して authoritative に突合する L3-007 用ドメインモデル。
+ *
+ * L2-016（bare ✅ の遮断＝参照の形状のみ）の authoritative 相棒。参照 id が本ランのテスト
+ * corpus から再生成された matrix 上に実在し、テスト参照を持つことを機械検証する。解決不能な
+ * 参照（空手形の attestation）は fail-closed の error として遮断する。
+ */
+
+/** coverage_report 内の 1 件の `<!-- @attestation <id> -->` 参照。 */
+export interface AttestationReference {
+  /** 参照 id（story-id 形式を期待。例 `H05-02`）。 */
+  readonly id: string;
+  /** 参照を含む coverage_report の project-relative パス。 */
+  readonly sourcePath: string;
+  /** 参照行（1 起点）。 */
+  readonly lineNumber: number;
+}
+
+/**
+ * matrix 由来の「解決可能なスコープ」集合。
+ * resolvableScopeIds = matrix 上に存在し、かつ testReferences を 1 件以上持つ story-id 集合。
+ */
+export interface AttestationScopeEvidence {
+  readonly resolvableScopeIds: ReadonlySet<string>;
+}
+
+/** 1 件の突合違反（解決不能な参照）。severity は常に 'error'（fail-closed / blocking tier）。 */
+export interface AttestationVerificationFinding {
+  readonly severity: "error";
+  readonly sourcePath: string;
+  readonly lineNumber: number;
+  readonly message: string;
+  readonly suggestion: string;
+}
+
+/**
+ * 突合判定レポート。findings はすべて error（fail-closed）。
+ */
+export class AttestationVerificationReport {
+  readonly findings: readonly AttestationVerificationFinding[];
+
+  private constructor(findings: readonly AttestationVerificationFinding[]) {
+    this.findings = Object.freeze([...findings]);
+    Object.freeze(this);
+  }
+
+  static create(findings: readonly AttestationVerificationFinding[]): AttestationVerificationReport {
+    return new AttestationVerificationReport(findings);
+  }
+
+  hasFindings(): boolean {
+    return this.findings.length > 0;
+  }
+}

package/scripts/harness/validator-system/domain/value-objects/validator-id.ts

@@ -13,6 +13,7 @@
  * WI-227 (H16-03) で L3-005（ac-bound-coverage, default-OFF fail-closed）を追加
  * WI-258 (ADR-030 §Decision.3.②) で L2-016（coverage-attestation-gating, fail-closed）を追加
  * WI-259 (ADR-030 §Decision.3.④) で L3-006（injection-scan, advisory warning-only）を追加
+ * WI-268 (ADR-030 §Decision.1・§Decision.3.② 第2段) で L3-007（coverage-attestation-verification, fail-closed）を追加
  */
 
 export class InvalidValidatorIdError extends Error {
@@ -43,6 +44,7 @@ const VALIDATOR_NAME_MAP: Record<string, string> = {
   "L3-004": "nyquist",
   "L3-005": "ac-bound-coverage",
   "L3-006": "injection-scan",
+  "L3-007": "coverage-attestation-verification",
   "L4-001": "drift-detect",
   "L4-002": "consistency-check",
   "L4-003": "dead-code",

package/scripts/harness/validator-system/infrastructure/adapters/file-system-coverage-attestation-verification-adapter.ts

@@ -0,0 +1,165 @@
+// @unit validator-system
+// @layer infrastructure
+// @work-item-id WI-268
+
+import { readdir, readFile } from "node:fs/promises";
+import { isAbsolute, join } from "node:path";
+import type {
+  CoverageAttestationVerificationCollectResult,
+  CoverageAttestationVerificationPolicyPort,
+} from "../../domain/ports/coverage-attestation-verification-policy-port.js";
+import type { AttestationReference } from "../../domain/value-objects/attestation-verification-report.js";
+
+const COVERAGE_REPORT_FILE = "coverage_report.md";
+const CONSTRUCTION_REL = join("docs", "product", "construction");
+const LEGACY_MARKER = /<!--\s*@coverage-gating:\s*ungated-legacy\s*-->/;
+/** `<!-- @attestation <id> -->` の id を捕捉する（1 行内複数を許容）。 */
+const ATTESTATION_REF_GLOBAL = /<!--\s*@attestation\s+([^\s>-][^>]*?)\s*-->/g;
+const DEFAULT_MATRIX_PATH = ".harness/requirement-test-matrix.json";
+
+interface MatrixTestReference {
+  readonly filePath?: string;
+}
+
+interface MatrixAcMapping {
+  readonly testReferences?: readonly MatrixTestReference[];
+}
+
+interface MatrixStory {
+  readonly storyId?: string;
+  readonly storyMappings?: readonly MatrixAcMapping[];
+  readonly acMappings?: readonly MatrixAcMapping[];
+}
+
+/**
+ * WI-268 / ADR-030 §Decision.1・§Decision.3.②（第2段） — L3-007 の走査・解決アダプタ。
+ *
+ * `docs/product/construction/*​/coverage_report.md` を cwd 起点で走査し（targetPaths 非依存の
+ * corpus 走査。L2-016 と同様に自前でファイル探索する）、ungated-legacy マーカー付きファイルを除外して
+ * `<!-- @attestation <id> -->` 参照を抽出する。
+ *
+ * 参照が 1 件以上ある場合のみ requirement-test-matrix を読み、resolvable scope
+ * （storyId 存在 かつ testReferences >= 1 の story-id 集合）を解決する。matrix 不在・parse 不能は
+ * fail-closed（matrixError を返す）。参照 0 件なら matrix を読まず空 evidence + matrixError=null。
+ */
+export class FileSystemCoverageAttestationVerificationAdapter
+  implements CoverageAttestationVerificationPolicyPort
+{
+  constructor(
+    private readonly projectRoot: string,
+    private readonly matrixFilePath: string = DEFAULT_MATRIX_PATH,
+  ) {}
+
+  async collect(): Promise<CoverageAttestationVerificationCollectResult> {
+    const references = await this.collectReferences();
+
+    // 参照が 1 件も無ければ matrix を読みに行かず PASS（最小副作用）。
+    if (references.length === 0) {
+      return Object.freeze({
+        references: Object.freeze([]),
+        evidence: { resolvableScopeIds: new Set<string>() },
+        matrixError: null,
+      });
+    }
+
+    const resolved = await this.resolveScopeEvidence();
+    if (resolved.error !== null) {
+      // 参照ありで matrix を読めない → fail-closed。
+      return Object.freeze({
+        references: Object.freeze(references),
+        evidence: { resolvableScopeIds: new Set<string>() },
+        matrixError: resolved.error,
+      });
+    }
+
+    return Object.freeze({
+      references: Object.freeze(references),
+      evidence: { resolvableScopeIds: resolved.scopeIds },
+      matrixError: null,
+    });
+  }
+
+  private async collectReferences(): Promise<AttestationReference[]> {
+    const constructionRoot = join(this.projectRoot, CONSTRUCTION_REL);
+    let unitDirs: string[];
+    try {
+      const entries = await readdir(constructionRoot, { withFileTypes: true });
+      unitDirs = entries.filter((e) => e.isDirectory()).map((e) => e.name);
+    } catch {
+      return [];
+    }
+
+    const references: AttestationReference[] = [];
+    for (const unitDir of unitDirs) {
+      const filePath = join(constructionRoot, unitDir, COVERAGE_REPORT_FILE);
+      let content: string;
+      try {
+        content = await readFile(filePath, "utf-8");
+      } catch {
+        continue;
+      }
+      const relPath = `${CONSTRUCTION_REL.replace(/\\/g, "/")}/${unitDir}/${COVERAGE_REPORT_FILE}`;
+      this.parseReferences(relPath, content, references);
+    }
+    return references;
+  }
+
+  /** ungated-legacy マーカー付きファイルは免除。それ以外は各 @attestation 参照を抽出する。 */
+  private parseReferences(path: string, content: string, out: AttestationReference[]): void {
+    const lines = content.split(/\r?\n/);
+    if (lines.some((line) => LEGACY_MARKER.test(line))) return;
+
+    for (let i = 0; i < lines.length; i++) {
+      const line = lines[i];
+      ATTESTATION_REF_GLOBAL.lastIndex = 0;
+      let match: RegExpExecArray | null = ATTESTATION_REF_GLOBAL.exec(line);
+      while (match !== null) {
+        const id = match[1].trim();
+        if (id.length > 0) {
+          out.push({ id, sourcePath: path, lineNumber: i + 1 });
+        }
+        match = ATTESTATION_REF_GLOBAL.exec(line);
+      }
+    }
+  }
+
+  private async resolveScopeEvidence(): Promise<{ scopeIds: Set<string>; error: string | null }> {
+    const relativeOrAbsolute = this.matrixFilePath.length > 0 ? this.matrixFilePath : DEFAULT_MATRIX_PATH;
+    const absPath = isAbsolute(relativeOrAbsolute)
+      ? relativeOrAbsolute
+      : join(this.projectRoot, relativeOrAbsolute);
+
+    let parsed: unknown;
+    try {
+      const raw = await readFile(absPath, "utf-8");
+      parsed = JSON.parse(raw);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      return {
+        scopeIds: new Set<string>(),
+        error: `requirement-test-matrix を読み込めません（L3-007 は fail-closed）: ${relativeOrAbsolute}: ${message}`,
+      };
+    }
+
+    const scopeIds = new Set<string>();
+    for (const story of this.extractStories(parsed)) {
+      const storyId = story.storyId;
+      if (!storyId) continue;
+      const mappings = story.storyMappings ?? story.acMappings ?? [];
+      const hasTestRef = mappings.some((ac) => (ac.testReferences?.length ?? 0) > 0);
+      if (hasTestRef) scopeIds.add(storyId);
+    }
+    return { scopeIds, error: null };
+  }
+
+  private extractStories(parsed: unknown): readonly MatrixStory[] {
+    if (typeof parsed !== "object" || parsed === null) return [];
+    const obj = parsed as { stories?: unknown; storyMappings?: unknown };
+    const raw = Array.isArray(obj.stories)
+      ? obj.stories
+      : Array.isArray(obj.storyMappings)
+        ? obj.storyMappings
+        : [];
+    return raw as readonly MatrixStory[];
+  }
+}

package/templates/.claude/scripts/deny-check.sh

@@ -90,11 +90,271 @@ glob_to_regex() {
     printf '%s' "$1" | sed 's/\*/.*/g'
 }
 
+# --- git subcommand allowlist (default-deny) ---------------------------------
+# Enumerated deny lists for git always leak (e.g. `git switch` slipped past the
+# `git checkout*` / `git reset*` deny rules). We therefore invert the policy for
+# git: only the subcommands below are permitted; every other git subcommand is
+# denied by default. To grant a new git subcommand, a human adds it here.
+#
+# Rationale for the set: read-only inspection, staging/commit/tag creation, and
+# worktree/fetch operations that agents legitimately use. History- and
+# working-tree-mutating subcommands (checkout, switch, reset, rebase, merge,
+# cherry-pick, revert, stash, clean, update-ref, reflog, filter-branch,
+# replace, am, ...) are intentionally absent so they fail closed.
+GIT_ALLOWED_SUBCOMMANDS=(
+    status log show diff add commit tag restore rev-parse rev-list
+    merge-base branch worktree fetch grep cat-file ls-files ls-tree
+    ls-remote init remote describe blame shortlog
+    for-each-ref name-rev check-ignore check-attr
+    stripspace var help version whatchanged push
+)
+
+# `symbolic-ref` is deliberately NOT in the allowlist above: its write form
+# (`git symbolic-ref HEAD refs/heads/<branch>` or `git symbolic-ref -d HEAD`)
+# re-points HEAD, i.e. it is a checkout-equivalent HEAD/history mutation that the
+# default-deny policy exists to block. Only the read form (reporting the ref HEAD
+# points at, e.g. `git symbolic-ref HEAD` / `git symbolic-ref --short HEAD`) is
+# state-preserving and therefore permitted. This guard, checked before the plain
+# allowlist, allows the read form and denies every write form.
+check_symbolic_ref() {
+    local segment="$1"
+    local sub
+    sub=$(extract_git_subcommand "$segment")
+    [[ "$sub" != "symbolic-ref" ]] && return 0
+
+    # Re-tokenize and walk to the subcommand, then inspect its arguments.
+    local -a tokens
+    read -ra tokens <<< "$segment"
+    local i=1
+    local n=${#tokens[@]}
+    # Advance past global options to the `symbolic-ref` token (mirrors
+    # extract_git_subcommand's flag handling so flag-stuffing cannot evade this).
+    while (( i < n )); do
+        case "${tokens[$i]}" in
+            -C|-c|--git-dir|--work-tree|--namespace|--exec-path|--config-env)
+                i=$(( i + 2 )) ;;
+            --git-dir=*|--work-tree=*|--namespace=*|--exec-path=*|--config-env=*)
+                i=$(( i + 1 )) ;;
+            --no-pager|--paginate|--no-replace-objects|--bare|--literal-pathspecs|--no-optional-locks|--html-path|--man-path|--info-path)
+                i=$(( i + 1 )) ;;
+            symbolic-ref)
+                break ;;
+            -*)
+                i=$(( i + 1 )) ;;
+            *)
+                break ;;
+        esac
+    done
+    # Skip the `symbolic-ref` token itself.
+    i=$(( i + 1 ))
+
+    # Count positional (non-flag) arguments after the subcommand. A read is
+    # `symbolic-ref [--short|-q] <name>` (<= 1 positional, no delete). A write is
+    # `symbolic-ref <name> <ref>` (>= 2 positionals) or `symbolic-ref -d <name>`.
+    local positional=0
+    while (( i < n )); do
+        local arg="${tokens[$i]}"
+        case "$arg" in
+            -d|--delete)
+                debug_log "BLOCKED git symbolic-ref delete form (segment '$segment')"
+                echo "Security policy violation: 'git symbolic-ref' delete form is denied (it mutates HEAD; only the read form is permitted). Segment: '$segment'." >&2
+                exit 2 ;;
+            -m|--reason)
+                # `-m <reason>` accompanies a write; the reason value consumes one token.
+                i=$(( i + 2 )); continue ;;
+            --short|-q|--quiet)
+                # Read-only modifiers; do not count as positionals.
+                : ;;
+            --)
+                : ;;
+            -*)
+                : ;;
+            *)
+                positional=$(( positional + 1 )) ;;
+        esac
+        i=$(( i + 1 ))
+    done
+
+    if (( positional >= 2 )); then
+        debug_log "BLOCKED git symbolic-ref write form (segment '$segment')"
+        echo "Security policy violation: 'git symbolic-ref' write form (re-pointing HEAD) is denied; it is checkout-equivalent HEAD mutation. Only the read form (e.g. 'git symbolic-ref HEAD') is permitted. Segment: '$segment'." >&2
+        exit 2
+    fi
+    # <= 1 positional and no delete: read form. Allowed.
+    return 0
+}
+
+# `config` is deliberately NOT in the allowlist above: its write form
+# (`git config <key> <value>`, `--unset`, `--add`, `--edit`, ...) can re-point
+# the hook path itself (`git config core.hooksPath <dir>`), which would disable
+# the entire L0 defence layer. Only read forms (`--get*`, `--list`/`-l`, or a
+# single <key> positional with no value) are state-preserving and therefore
+# permitted. Ambiguous invocations fail closed; read forms combined with scope
+# flags (`--global --list`, `--local --get <key>`, ...) are legitimate and pass.
+check_git_config() {
+    local segment="$1"
+    local sub
+    sub=$(extract_git_subcommand "$segment")
+    [[ "$sub" != "config" ]] && return 0
+
+    # Re-tokenize and walk to the subcommand, then inspect its arguments.
+    local -a tokens
+    read -ra tokens <<< "$segment"
+    local i=1
+    local n=${#tokens[@]}
+    # Advance past global options to the `config` token (mirrors
+    # extract_git_subcommand's flag handling so flag-stuffing cannot evade this).
+    while (( i < n )); do
+        case "${tokens[$i]}" in
+            -C|-c|--git-dir|--work-tree|--namespace|--exec-path|--config-env)
+                i=$(( i + 2 )) ;;
+            --git-dir=*|--work-tree=*|--namespace=*|--exec-path=*|--config-env=*)
+                i=$(( i + 1 )) ;;
+            --no-pager|--paginate|--no-replace-objects|--bare|--literal-pathspecs|--no-optional-locks|--html-path|--man-path|--info-path)
+                i=$(( i + 1 )) ;;
+            config)
+                break ;;
+            -*)
+                i=$(( i + 1 )) ;;
+            *)
+                break ;;
+        esac
+    done
+    # Skip the `config` token itself.
+    i=$(( i + 1 ))
+
+    # Classify the arguments after the subcommand.
+    #   read flags  -> explicitly allowed (`--get`, `--list`, ...)
+    #   write flags -> explicitly denied (`--unset`, `--add`, `--edit`, ...)
+    #   positionals -> counted: 1 positional with no write indicator is the
+    #                  `git config <key>` read; >= 2 positionals is the
+    #                  `git config <key> <value>` write (fail closed).
+    # Scope flags (`--global`, `--system`, `--local`, `--worktree`) and other
+    # modifiers are neutral: the verdict is driven by read/write flags and the
+    # positional count, so `--global --list` passes and `--global k v` fails.
+    local read_flag=0
+    local positional=0
+    while (( i < n )); do
+        local arg="${tokens[$i]}"
+        case "$arg" in
+            --unset|--unset-all|--add|--replace-all|--edit|-e|--remove-section|--rename-section|--set*)
+                debug_log "BLOCKED git config write flag '$arg' (segment '$segment')"
+                echo "Security policy violation: 'git config' write form ('$arg') is denied; config writes can re-point hooks (core.hooksPath) and disable the L0 defence layer. Only read forms (--get/--get-all/--get-regexp/--list/-l or a bare <key>) are permitted. Segment: '$segment'." >&2
+                exit 2 ;;
+            --get|--get-all|--get-regexp|--get-urlmatch|--get-color|--get-colorbool|--list|-l)
+                read_flag=1 ;;
+            --file|-f|--blob|--default|--type)
+                # Neutral flags that consume a separate value token.
+                i=$(( i + 2 )); continue ;;
+            --file=*|--blob=*|--default=*|--type=*)
+                : ;;
+            --)
+                : ;;
+            -*)
+                # Scope flags and other modifiers: neutral, do not count.
+                : ;;
+            *)
+                # New-style verb subcommands (git >= 2.46) that mutate config.
+                if (( positional == 0 )); then
+                    case "$arg" in
+                        set|unset|edit|rename-section|remove-section)
+                            debug_log "BLOCKED git config verb '$arg' (segment '$segment')"
+                            echo "Security policy violation: 'git config $arg' is a config write form and is denied; config writes can re-point hooks (core.hooksPath) and disable the L0 defence layer. Segment: '$segment'." >&2
+                            exit 2 ;;
+                    esac
+                fi
+                positional=$(( positional + 1 )) ;;
+        esac
+        i=$(( i + 1 ))
+    done
+
+    # Explicit read flag: allowed regardless of positional count
+    # (`--get <key>`, `--get-regexp <pattern>`, `--get-urlmatch <key> <url>`).
+    (( read_flag == 1 )) && return 0
+
+    if (( positional >= 2 )); then
+        debug_log "BLOCKED git config write form (segment '$segment')"
+        echo "Security policy violation: 'git config' write form (<key> <value>) is denied; config writes can re-point hooks (core.hooksPath) and disable the L0 defence layer. Only read forms (--get/--get-all/--get-regexp/--list/-l or a bare <key>) are permitted. Segment: '$segment'." >&2
+        exit 2
+    fi
+    # <= 1 positional and no write indicator: value read (`git config <key>`)
+    # or a no-op. Allowed.
+    return 0
+}
+
+# Extract the git subcommand from a segment, skipping the `git` binary and any
+# global options that may precede the subcommand:
+#   git -C <path> <sub>        git --no-pager <sub>
+#   git -c key=val <sub>       git --git-dir=<dir> <sub>
+#   git --work-tree <dir> <sub>
+# Prints the subcommand (or empty string if none / not a git command).
+extract_git_subcommand() {
+    # Tokenize on whitespace.
+    local -a tokens
+    read -ra tokens <<< "$1"
+    [[ "${tokens[0]}" != "git" ]] && return 0
+    local i=1
+    local n=${#tokens[@]}
+    while (( i < n )); do
+        local tok="${tokens[$i]}"
+        case "$tok" in
+            # Global flags that take a separate argument.
+            -C|-c|--git-dir|--work-tree|--namespace|--exec-path|--config-env)
+                i=$(( i + 2 ))
+                ;;
+            # Global flags bundled with their value (=), or standalone toggles.
+            --git-dir=*|--work-tree=*|--namespace=*|--exec-path=*|--config-env=*)
+                i=$(( i + 1 ))
+                ;;
+            --no-pager|--paginate|--no-replace-objects|--bare|--literal-pathspecs|--no-optional-locks|--html-path|--man-path|--info-path)
+                i=$(( i + 1 ))
+                ;;
+            -*)
+                # Unknown global flag; skip conservatively.
+                i=$(( i + 1 ))
+                ;;
+            *)
+                printf '%s' "$tok"
+                return 0
+                ;;
+        esac
+    done
+    return 0
+}
+
+check_git_allowlist() {
+    local segment="$1"
+    local sub
+    sub=$(extract_git_subcommand "$segment")
+    # Not a git command, or `git` with no subcommand (e.g. `git`, `git --help`).
+    [[ -z "$sub" ]] && return 0
+    # `symbolic-ref` is adjudicated by check_symbolic_ref (read form allowed,
+    # write form denied); do not treat its absence from the allowlist as a deny.
+    [[ "$sub" == "symbolic-ref" ]] && return 0
+    # `config` is adjudicated by check_git_config (read forms allowed, write
+    # forms denied); do not treat its absence from the allowlist as a deny.
+    [[ "$sub" == "config" ]] && return 0
+    local allowed
+    for allowed in "${GIT_ALLOWED_SUBCOMMANDS[@]}"; do
+        [[ "$sub" == "$allowed" ]] && return 0
+    done
+    debug_log "BLOCKED git subcommand '$sub' not in allowlist (segment '$segment')"
+    echo "Security policy violation: git subcommand '$sub' is not in the agent allowlist (default-deny for git). Segment: '$segment'. If this subcommand is genuinely needed, a human must add it to GIT_ALLOWED_SUBCOMMANDS in .claude/scripts/deny-check.sh." >&2
+    exit 2
+}
+
 check_segment() {
     local segment="$1"
     # Strip leading whitespace so "^pattern" anchors match after operators.
     segment="${segment#"${segment%%[![:space:]]*}"}"
     [[ -z "$segment" ]] && return 0
+    # git subcommands are default-deny (allowlist); check that first.
+    # symbolic-ref and config get a dedicated read-vs-write adjudication before
+    # the plain allowlist (their write forms mutate HEAD / the hook path and
+    # must fail closed).
+    check_symbolic_ref "$segment"
+    check_git_config "$segment"
+    check_git_allowlist "$segment"
     for pattern in "${DENY_PATTERNS[@]}"; do
         local regex_pattern
         regex_pattern=$(glob_to_regex "$pattern")