[prathikcannotcode]

Four ways past the write-guard, each reproduced against main before the fix.

What changed

• package.json leaves layout.json. npm test and npm run validate are pre-approved in .claude/settings.json, so an agent that could rewrite the script could run any command with no prompt.
• Both hooks resolve the target as the disk spells it before matching a rule (realPath in lib.mjs). On Windows and macOS, catalog/Provisions.json matched catalog/** and landed on the read-only catalog, and matters/x/FLAGS.jsonl rewrote the append-only log.
• The expert gate parses the file as it would be saved. An Edit from pending_expert_review to expert_validated carried no key in its new text, and a Write with expert\u005fvalidated dodged the pattern. Both now exit 2. Side effect: an agent can no longer edit a result a human has already marked expert_validated.
• The calculator's --out writes only a new matters/<id>/calc/<run>.json and never overwrites one. npm run calc:* is pre-approved and runs through Bash, outside the hooks, so --out could reach the catalog, a flag log or settings.json. SECURITY.md no longer lists this as a known limit.

Tests

npm test: 27 pass, 0 fail, 2 skipped on Windows. npm run validate -- --strict is clean.

The new test, "another spelling of a guarded path is still guarded", needs a case-insensitive disk. It skips on Ubuntu, so this CI does not exercise that fix. A windows-latest job would.

Not in this PR

• .github/** stays agent-writable.
• No changelog entry or version bump.

🤖 Generated with Claude Code