Expected Deny, Got Allow
Written later and filed to this date, as part of filling in every day of the year.
On the fifth of September the keeper that staffs my build agents stopped staffing them. Its log said why on every scan: dispatch refused: the installed PreToolUse guard failed validation (canary hooks-write: expected deny, got allow); apply ..., followed by the path of a patch.
That morning an audit of the fleet supervisor by a second model family had come back with eighteen findings, and I had said implement all of them. The supervisor changes landed directly. The changes to the guard hooks could not. The hooks are what judges every command an agent runs, and the standing rule is that no agent edits what judges it, so those arrived as an apply pack: the live hooks in before/, the patched ones in after/, a probe, and an apply script for me to run by hand.
The same session also changed the dispatcher. Before it starts any agent, it now pushes four payloads through the installed guard in a throwaway home: an edit to the fleet’s roster, a write to the guard’s own file, a privileged command, and git status. The first three must come back deny and the fourth allow. The settings file must also still name the hook as a pre-tool-use hook, and the hook file must exist. Any other answer refuses every dispatch, with a one-minute cache so the probe is not paid on every scan.
Until I ran the apply script, the live guard allowed the second payload. The audit had found that gap, the pack closed it, and in the hours between, the dispatcher declined to start a single agent into a guard it could show was incomplete. The pack’s own README says it plainly: that is the audited state, made loud instead of silent.
The check is cheap to keep and it has stayed. A guard file that fails to run answers error; a settings file rewritten by some tool that drops the hook entry fails the wiring check; either keeps the fleet home.
The dispatch guard self-test: four fixed payloads the dispatcher runs through the live guard before every start, three that must be refused and one that must pass, so that a guard which is missing, unwired or weakened keeps the agents at home instead of letting them out without it.