[chrispezza]

What

An agent could rewrite the policy that gates it and nothing objected. A Write or Edit of ~/.bouncer/bouncer.yaml or a repository's .bouncer.yaml was judged ask, and in seatbelt a judged ask reaches nobody. One installed log holds two such edits.

• A label. describeSensitivity returns gate_policy for the two names resolvePolicy looks for.
• A predicate. target_labelled is true when the file a Write, Edit or NotebookEdit would change carries a label. Every hard-rule predicate until now read a command line, so no entry could see those tools.
• Three shipped entries that read the label, shipped as ask like every entry:

entry	catches
edits-the-gate-policy	every Write and Edit of the file
removes-or-overwrites-the-gate-policy	rm, unlink, shred, mv, truncate, tee on it
edits-the-gate-policy-in-place	sed -i, perl -i on it

The decision in it

In guard and full the edit prompts. In seatbelt it is denied, and the way through is to edit the file yourself. That is friction, chosen: the mode is for sessions nobody is watching, and this is the file that says what such a session may not do. ADR-013 has the argument, and ADR-012 decides the opposite for this repository's own records.

What it does not catch

cp onto the file, a redirect onto it, and a script. cp is left out because the verb cannot say which argument is written, and the same command with its arguments swapped is a backup. Both gaps are in the frozen holdout as named dangerous false accepts, so the suite asserts them. Reading the policy is not stopped.

Flagged

• Attack surface: reduced. No new endpoint, input or file read.
• A copied policy does not get the entries (same gap as A copied policy keeps a superseded hard rule, and nothing says so (git-push-force-refspec heredoc false positives) #126). The changelog carries the block to paste.
• A policy using target_labelled needs 0.2.16. An older bouncer rejects the unknown key and stops enforcing, with one message per session. Update first, then edit the policy.
• CACHE_VERSION 7 to 8, for the new field on HardRuleWhen.
• The holdout checksum moved: 14 cases added, none changed or removed.

Cost

Paired bench against the base commit's bundle and policy, 50 pairs, M4:

case	paired median	limit
judged	+0.2%	+10%
hard-rule	-0.6%	+10%

Three entries are YAML nodes, about 0.37 ms each on a cold parse and nothing cached. No Jev call, no D1, one CI run.

Verified

npm test: 36 files, 1551 tests. npm run typecheck clean. Bundle rebuilt. The holdout expectations were read off the built hook, not assumed.

Closes #141

🤖 Generated with Claude Code