From 41937b8959d7168b6fc1ba54339837308fdff769 Mon Sep 17 00:00:00 2001
From: Remi Antczak <140408771+remigiusz-antczak@users.noreply.github.com>
Date: Fri, 30 Oct 2026 20:43:17 +0100
Subject: [PATCH] Wave 11: guard registry, privacy guard on GitHub writes,
 new-row flags in review_checks
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Guard registry (refs #1592):
- Every guard rail Perun ships has one row in scripts/guard-registry.tsv: id,
  owner role (never a person), reason, review-by date and an optional fire
  log path. A guard is a hook a shipped settings template runs, a git hook
  install.sh writes, or a ci-gates.sh subcommand.
- ci-gates.sh guard-registry fails closed on a guard with no row, an empty
  reason, an owner that is not a lowercase role slug, a review-by that is not
  a real calendar day, a duplicate or over-wide row, a row for a guard that no
  longer ships, an empty scan, and a cmd_ function whose dispatcher line the
  scan cannot read. A past review-by never fails it.
- guard-registry --report [--days N] is read-only: rows past review-by, and
  logged guards with no dated fire line in the last N days. A guard with no
  fire log, or an empty, rotated or undated one, is "unknown", never "zero
  fires". The report never edits or deletes a row.
- The header-parity test pins each hook row's owner, reason and review date
  to its script's `# rail:` line. Evil-twin record: keeping both the headers
  and the TSV can drift; if they still disagree after about 30 days, retire
  one.

Privacy guard (new hook, agentic-delivery/privacy_guard.py):
- A PreToolUse(Bash) hook runs the repo's banlist (.banlist.txt, then the
  gitignored .banlist.local.txt at the git top-level; a linked worktree reads
  the main checkout's local file) over the title and body of every gh
  pr|issue|release create|edit|comment and every curl or gh api write to
  repos/<owner>/<repo>/pulls or /issues in the command. A hit exits 2 with a
  reason that names the title or the body line and the pattern's number,
  never the matched text. No repo, no banlist, no title or body, an
  unreadable body file (a readable title is still checked), bad input or
  any error allows; PERUN_PRIVACY_GUARD=off opts out.
- Scope: the banlist covers writes into the session's own repository,
  into protocol/perun and into any repository under another owner. A write
  whose explicit target (read from that write's own flags, never from its
  title, body or a later command) is a different repository under the
  session origin's owner is not scanned, so an audit PR may name the repo
  it is filed in. A write naming several repositories is skipped only when
  every one is a sibling. With no usable origin every write is scanned.
  Known residuals, documented in the module: a public sibling repository in
  the session's own organisation is not scanned, a write into another
  owner's private repository is still scanned (a private target cannot be
  told from a public one without a network call), and a target set only by
  GH_REPO is not seen.
- `-f`/`--raw-field` text is scanned as written even when it starts with
  `@`; only `-F`/`--field` reads `@FILE`, and a failed read scans the
  literal text.
- A body file the command writes itself (`> F`, `>> F`, `tee F`) is read from
  the heredoc that feeds that file, not from the stale or missing file.
- Own-repository rule: a write into Perun's public repository from another
  repository's session is denied when its title or body names the session's
  repository (owner/name, or the bare name when distinctive), because a
  project's banlist does not list its own name. The reason gives the location
  only.
- comms_guard.py extraction, shared by import: `-F body=@FILE` reads @FILE
  as one shell word, and `_flags` masks quoted strings and heredoc bodies so
  a flag-like word inside a title or body is not taken for a flag.
- Wired into the operating-layer template, perun_doctor HOOK_SCRIPTS, a
  guard-registry row, a `# rail:` header and a changelog fragment. Unscanned
  forms (stdin pipes, merge and review, --fill, text built from a shell
  variable) are listed in the module docstring.

Review (review_checks.sh):
- In diff mode every JSON row carries "new": true|false, true when the row's
  file and line sit on a line BASE...HEAD adds (rename-aware `git diff -U0`
  with pinned flags, so a reviewer's git config cannot change which lines
  count). Line 0 and file-level rows are false; --full and --history omit
  the key; no row is dropped. stderr gains "review_checks: N of M rows are on
  lines this diff adds".
- references/method-situational.md: verify new rows first, and report a
  pre-existing row in a touched file only when the diff makes it reachable or
  worse.

Index: the agentic-delivery script-lookup cap in
scripts/test_skill_index_split.py rises by 200 bytes for the new
privacy_guard row (core plus lazy index measured at 22303 bytes).

size-budget-raise: .claude/skills/deep-code-review/references/method-situational.md 44396→44702 one sentence on the new flag: verify new rows first, report a pre-existing row only when the diff makes it reachable or worse

Tests: 259/259 in the 9 suites affected by the last two commits, re-run
at the final head (audit-pr-body 46, comms-quality 51, conflict-free-prs
23, guard-registry 92, privacy-guard 40, skill-index-split 7). Earlier
assembly runs: the suites affected by the first commits were green; 47 of
the 48 suites affected by the review round were green and the 48th (the
index cap) is fixed here. The full set runs in CI.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .claude/skills/INDEX.md                       |   2 +-
 .../skills/agentic-delivery/INDEX-scripts.md  |   1 +
 .claude/skills/agentic-delivery/INDEX.md      |   2 +-
 .../agentic-delivery/scripts/comms_guard.py   |  44 +-
 .../agentic-delivery/scripts/privacy_guard.py | 239 ++++++++++
 .../templates/operating-layer.settings.json   |  10 +
 .claude/skills/deep-code-review/INDEX.md      |   2 +-
 .../references/method-situational.md          |   2 +-
 .../deep-code-review/scripts/review_checks.sh |  18 +-
 SHA256SUMS                                    |  15 +-
 changelog.d/guard-registry.md                 |   7 +
 changelog.d/privacy-guard.md                  |  13 +
 changelog.d/review-checks-new-rows.md         |   5 +
 scripts/ci-gates.sh                           | 128 +++++
 scripts/ci-tests.d/guard-registry.sh          |   2 +
 scripts/ci-tests.d/privacy-guard.sh           |   2 +
 scripts/ci-tests.d/review-checks-new-rows.sh  |   2 +
 scripts/guard-registry.tsv                    |  51 ++
 scripts/perun_doctor.py                       |   2 +-
 scripts/size-budgets.tsv                      |   6 +-
 scripts/test-guard-registry.sh                | 239 ++++++++++
 scripts/test-review-checks-new-rows.sh        |  63 +++
 scripts/test_privacy_guard.py                 | 437 ++++++++++++++++++
 scripts/test_skill_index_split.py             |   2 +-
 24 files changed, 1265 insertions(+), 29 deletions(-)
 create mode 100644 .claude/skills/agentic-delivery/scripts/privacy_guard.py
 create mode 100644 changelog.d/guard-registry.md
 create mode 100644 changelog.d/privacy-guard.md
 create mode 100644 changelog.d/review-checks-new-rows.md
 create mode 100644 scripts/ci-tests.d/guard-registry.sh
 create mode 100644 scripts/ci-tests.d/privacy-guard.sh
 create mode 100644 scripts/ci-tests.d/review-checks-new-rows.sh
 create mode 100644 scripts/guard-registry.tsv
 create mode 100644 scripts/test-guard-registry.sh
 create mode 100644 scripts/test-review-checks-new-rows.sh
 create mode 100644 scripts/test_privacy_guard.py

diff --git a/.claude/skills/INDEX.md b/.claude/skills/INDEX.md
index a88c3b0cf..caf4ac712 100644
--- a/.claude/skills/INDEX.md
+++ b/.claude/skills/INDEX.md
@@ -109,7 +109,7 @@ Run `python3 <skill>/scripts/<name>` (`bash` for `.sh`). `name: purpose — argu
 - vacuous_test_gate.py: a changed test file must really run and assert. — [REPORT] (--changed PATH... | --base…
 - vendor_drift.py: list vendored skill files in TARGET that differ from the… — TARGET [--src DIR]
 - wired_check.py: warn when a NEW script has no caller. — BASE HEAD [--root DIR]
-- No documented CLI: _clean_union.sh, _dirty_guard.sh, _lock.sh, admission_check.py, board_common.py, bypass_guard.py, ceo_altitude_guard.py, comms_guard.py, context_nudge.py, cost_statusline.py, decision_gate.py, destructive_guard.py, destructive_guard_core.py, finding_guard.py, flake_ledger.py, freeze_hook.py, gh_rest.py, handback_cap.py, handoff_inject.py, heavy_gate.py, host_accept.py, host_installer.py, host_safety.py, landing_watchdog.py, lane_cap.py, lane_resume_nudge.py, lkg.py, outcome_claim_guard.py, peer_ack.py, perun_auto_update.py, pipe_mask_guard.py, pipeline_profile.py, plan_gate.py, pregate_parity.py, red_main.py, repeat_poll_guard.py, reply_cap.py, restore_ledger.py, scope_creep_check.py, session_brief.py, stall_guard.py, subagent_brief_lint.py, surface_check.py, terse_reply_check.py
+- No documented CLI: _clean_union.sh, _dirty_guard.sh, _lock.sh, admission_check.py, board_common.py, bypass_guard.py, ceo_altitude_guard.py, comms_guard.py, context_nudge.py, cost_statusline.py, decision_gate.py, destructive_guard.py, destructive_guard_core.py, finding_guard.py, flake_ledger.py, freeze_hook.py, gh_rest.py, handback_cap.py, handoff_inject.py, heavy_gate.py, host_accept.py, host_installer.py, host_safety.py, landing_watchdog.py, lane_cap.py, lane_resume_nudge.py, lkg.py, outcome_claim_guard.py, peer_ack.py, perun_auto_update.py, pipe_mask_guard.py, pipeline_profile.py, plan_gate.py, pregate_parity.py, privacy_guard.py, red_main.py, repeat_poll_guard.py, reply_cap.py, restore_ledger.py, scope_creep_check.py, session_brief.py, stall_guard.py, subagent_brief_lint.py, surface_check.py, terse_reply_check.py
 
 ### business-ops
 - bizops_check.py: Deterministic arithmetic checks business-ops already states… — [input.json] (stdin when no path)
diff --git a/.claude/skills/agentic-delivery/INDEX-scripts.md b/.claude/skills/agentic-delivery/INDEX-scripts.md
index b198341f7..3275c72d8 100644
--- a/.claude/skills/agentic-delivery/INDEX-scripts.md
+++ b/.claude/skills/agentic-delivery/INDEX-scripts.md
@@ -77,6 +77,7 @@ Generated by `scripts/skill_index.py` (do not hand-edit). The script half of `IN
 | `scripts/premise_check.py` | before handing PRs or issues to a lane or peer, say which are already done or stale. | premise_check.py N [N ...] [--repo OWNER/NAME] [--timeout S] |
 | `scripts/prevention_lint.py` | every prevention/action item needs an owner, a tracking id and a verifiable end state. | prevention_lint.py FILE.md |
 | `scripts/priority_gate.py` | no presentation-only PR while an aged P0/mechanism issue has no PR citing it. | priority_gate.py --labels-json FILE [options] priority_gate.py --repo OWNER/REPO --pr N [options] priority_gate.py --se… |
+| `scripts/privacy_guard.py` | PreToolUse(Bash) hook: DENY a GitHub write whose title or body matches the repo's banlist (a write… | — |
 | `scripts/queue_guard.py` | single priority queue: print the next issue to pull, flag P0 inflation. | queue_guard.py --issues issues.json --priorities PRIORITIES.md [--max-unranked N] issues.json gh issue list --json numb… |
 | `scripts/reap_own.sh` | kill your own dev servers older than MAX_AGE_S whose cwd is under ROOT (your own lane or session tr… | reap_own.sh |
 | `scripts/red_main.py` | green-main alarm: every red test on the default branch needs a fix or an owner within 1h. | — |
diff --git a/.claude/skills/agentic-delivery/INDEX.md b/.claude/skills/agentic-delivery/INDEX.md
index 801f10afd..19740a9ee 100644
--- a/.claude/skills/agentic-delivery/INDEX.md
+++ b/.claude/skills/agentic-delivery/INDEX.md
@@ -38,4 +38,4 @@ Generated by `scripts/skill_index.py` (do not hand-edit; rerun it after changing
 
 ## Scripts
 
-109 scripts. Read `INDEX-scripts.md` when you need a script (a trigger and CLI per script). `../INDEX.md`, `### agentic-delivery`, has only each one-line purpose and arguments.
+110 scripts. Read `INDEX-scripts.md` when you need a script (a trigger and CLI per script). `../INDEX.md`, `### agentic-delivery`, has only each one-line purpose and arguments.
diff --git a/.claude/skills/agentic-delivery/scripts/comms_guard.py b/.claude/skills/agentic-delivery/scripts/comms_guard.py
index 2992f5c20..755a94d9f 100644
--- a/.claude/skills/agentic-delivery/scripts/comms_guard.py
+++ b/.claude/skills/agentic-delivery/scripts/comms_guard.py
@@ -34,11 +34,22 @@
 REST = re.compile(r"(?:\bcurl\b|\bgh\s+api\b)[\s\S]{0,600}?\brepos/[^/\s'\"]+/[^/\s'\"]+/(pulls|issues)((?:/\d+)?(?:/(?:comments|reviews))?)(?=[\s'\"?]|$)")
 HEREDOC = re.compile(r"<<-?[ \t]*(['\"]?)(\w+)\1[ \t]*\n(.*?)\n[ \t]*\2[ \t]*(?=\n|\)|\"|'|$)", re.S)
 VALUE = re.compile(r"\"((?:[^\"\\]|\\.)*)\"|'([^']*)'|(\S+)", re.S)
+QUOTED = re.compile(r"\\.|'[^']*'|\"(?:[^\"\\]|\\.)*\"", re.S)  # an escape, or a complete quoted string
+
+
+def _plain(tail, keep=None):
+    """`tail` with each heredoc body and each quoted string blanked to NULs, the same length so offsets line up; `keep(string)` true
+    spares a quoted string. Stray quotes in a heredoc body pair with nothing, and an unclosed quote hides nothing."""
+    plain = list(tail)
+    for h in HEREDOC.finditer(tail):
+        plain[h.start(3):h.end(3)] = "\0" * len(h.group(3))
+    return QUOTED.sub(lambda m: m.group() if m.group()[0] == "\\" or (keep and keep(m.group())) else "\0" * len(m.group()), "".join(plain))
 
 
 def _flags(tail, names):
-    """Yield the raw text after each occurrence of a flag in `names` (regex alternation), `--flag value` or `--flag=value`."""
-    for m in re.finditer(rf"(?:^|\s)(?:{names})(?:=|[ \t]+)", tail):
+    """Yield the raw text after each occurrence of a flag in `names` (regex alternation), `--flag value` or `--flag=value`.
+    A flag-like word inside a quoted string (the title "Add -b flag") or a heredoc body is not a flag."""
+    for m in re.finditer(rf"(?:^|\s)(?:{names})(?:=|[ \t]+)", _plain(tail)):
         yield tail[m.end():]
 
 
@@ -82,21 +93,30 @@ def _gh_body(tail, noun, cwd):
     return None
 
 
-def _rest_body(tail, cwd):
-    for rest in _flags(tail, r"-f|-F|--field|--raw-field"):  # gh api -f body=TEXT, -f 'body=TEXT', -F body=@FILE
-        q = re.match(r"([\"'])body=", rest)
-        if q:
-            return _value(q.group(1) + rest[q.end():], cwd)
-        if rest.startswith("body="):
-            return _file(rest[5:], cwd, tail) if rest[5:].startswith("@") else _value(rest[5:], cwd)
+def _rest_field(tail, cwd, key, literal=False):
+    """The text of one field (`body`, `title`) a REST write sends, or None if it is absent or unreadable. gh sends `-f`/`--raw-field`
+    text as typed (`@jane` is a mention) and reads `-F`/`--field` `@FILE`; `literal` gives an unreadable `@FILE` as typed, not an error."""
+    for names, at_file in ((r"-f|--raw-field", False), (r"-F|--field", True)):  # gh api -f body=TEXT, -f 'body=TEXT', -F body=@FILE
+        for rest in _flags(tail, names):
+            q = re.match(rf"([\"']){key}=", rest)
+            if q or rest.startswith(key + "="):
+                val = _value(q.group(1) + rest[q.end():] if q else rest[len(key) + 1:], cwd)  # one shell word: more arguments may follow
+                if not (at_file and val and val.startswith("@")):
+                    return val
+                try:
+                    return _file(val, cwd, tail)
+                except (OSError, ValueError):
+                    if literal:
+                        return val
+                    raise
     for rest in _flags(tail, r"-d|--data|--data-raw|--data-binary"):  # curl -d '{"body": ...}' or -d @FILE
         raw = _value(rest, cwd)
         raw = _file(raw, cwd, tail) if raw and (raw.startswith("@") or raw == "-") else raw
-        return json.loads(raw).get("body") if raw else None
+        return json.loads(raw).get(key) if raw else None
     for rest in _flags(tail, r"--input"):  # gh api --input FILE
         name = _value(rest, cwd)
         raw = _file(name, cwd, tail) if name else None
-        return json.loads(raw).get("body") if raw else None
+        return json.loads(raw).get(key) if raw else None
     return None
 
 
@@ -116,7 +136,7 @@ def extract(tool_name, tool_input, cwd=""):
             body = _gh_body(cmd[m.start():], noun, cwd)
         elif (m := REST.search(cmd)):
             kind = "pr" if m.group(1) == "pulls" and not m.group(2).endswith(("comments", "reviews")) else "message"
-            body = _rest_body(cmd[m.start():], cwd)
+            body = _rest_field(cmd[m.start():], cwd, "body")
         else:
             return None
     except (OSError, ValueError, AttributeError):  # unreadable file, non-JSON data: nothing to lint
diff --git a/.claude/skills/agentic-delivery/scripts/privacy_guard.py b/.claude/skills/agentic-delivery/scripts/privacy_guard.py
new file mode 100644
index 000000000..ed2e5d95f
--- /dev/null
+++ b/.claude/skills/agentic-delivery/scripts/privacy_guard.py
@@ -0,0 +1,239 @@
+#!/usr/bin/env python3
+# rail: owner=agentic-delivery, why=deny a GitHub write whose title or body matches the repo banlist except into a sibling repo of the origin owner and deny a write into Perun that names the session repository, review=2027-01-30
+"""privacy_guard.py — PreToolUse(Bash) hook: DENY a GitHub write whose title or body matches the repo's banlist (a write into a sibling
+repository of the session origin's owner is not scanned), and a write into the public Perun repository (SELF_REPO) that names the
+repository of the session it is filed from.
+
+WHY: the privacy gate scans the files a repo ships, and nothing scanned the text an agent publishes through `gh` or the API, so a
+public issue body that named a private repository stayed up for weeks. This hook runs the repo's own banlist over the title and
+body of each GitHub write before it is sent. A project's banlist does not list the project's own name (it is all over its files), so a
+field report filed from that project's session into the public Perun repository carried the name past the banlist; the own-repository
+rule below closes that.
+
+Covers what comms_guard.py covers, through its extraction (imported, not copied): Bash `gh pr|issue|release create|edit|comment`,
+and `curl` or `gh api` calls to repos/<owner>/<repo>/pulls or /issues. Title: `--title`/`-t`, `-f title=...`, JSON `title`. Body:
+`--body`/`-b`/`--notes`, a heredoc, `$(cat FILE)`, `--body-file`/`-F FILE`, `-d`/`--input` JSON, `-f body=...`, `-F body=@FILE`. `-f`
+text is scanned as typed (`@jane` is a mention); `-F` reads `@FILE`, and a file it cannot read is scanned as typed. Every write in a
+command is read. A body file the same command writes (`> F`, `>> F`, `tee F`) is read from the heredoc that feeds it, not from the
+disk, which holds an old copy or none; what it writes any other way (`echo`, `printf`, `cp`) is not read. Not covered: `gh pr
+merge|review`, `gh issue|pr close --comment`, `gh repo edit`, `--fill`, PATCH of `issues/comments/ID`, POST of `pulls/N/comments/M/replies`,
+`repos/<o>/<r>/releases`, `gh api graphql`, `curl --data-urlencode` and `--json`; a body fed to stdin by a pipe or `<` (`-F -`,
+`--body-file -`; a heredoc is read); text that a shell variable or a command substitution other than `cat FILE` produces at run time; a
+single-quoted value with an escaped quote inside, a `$'...'` string, `-b"text"` with no space; a relative body file after `cd DIR &&`
+(read from the payload `cwd`, not DIR).
+
+Patterns: the actionable lines (non-blank, first non-space character not `#`) of `.banlist.txt`, then `.banlist.local.txt`, at the git
+top-level of the payload `cwd`; a linked worktree lacks the gitignored local file, so the main checkout's is read instead. Each line
+is an ERE run through `grep -E` over each line of the text, as `scripts/ci-gates.sh privacy` does: case-sensitive, and an invalid ERE
+is skipped here (the gate fails closed on it).
+
+Scope: the banlist is the session repo's and runs over every write except one whose explicit target is another repository of the
+session origin's owner (a sibling): a private repository's name belongs in a write into that repository. The session's own repository
+(named or implicit), SELF_REPO, every other owner's repository and a session with no usable `origin` stay scanned: a private target
+cannot be told from a public one without a network call, and a wrong deny is cheaper than a leak. Residuals: a public sibling in the
+origin's organisation is not scanned, and another owner's private repository is, so a legitimate name in it is denied. The target is
+`-R`/`--repo OWNER/REPO` (quoted, or with a `github.com/` host), a github.com URL, or a `repos/OWNER/REPO/(issues|pulls)` path, read from
+the write's own region only: from the write to the next gh or curl write or the end of its command line (`&&`, `||`, `;`, `|`, a
+newline, a `#` comment), with each heredoc body, each quoted string that holds a space and a one-word title or body blanked first, so
+text that only mentions a repository (a body quoting `-R acme/other`, a later `echo`) sets no target. A `.git` suffix is dropped. A
+write that names several repositories is skipped only when every one is a sibling; a target set by `GH_REPO` is not seen.
+
+Own-repository rule: a write that targets SELF_REPO (read as above) from a session whose `origin` remote names another repository is
+denied when its title or a body line names that repository, as `owner/name` or as the bare name (case-insensitive, whole word; a short
+plain name is skipped, see `_own_names`). No network: a missing `origin`, an unparsable URL or a session inside SELF_REPO has no such
+rule, and a target set by `GH_REPO` is not seen.
+
+Output: on a hit, exit 2 and a stderr reason that names each hit as `title` or `body line N`, a banlist hit adding the pattern's 1-based
+number among the actionable lines above. The matched text and the repository's name are never printed. Otherwise exit 0 and print nothing.
+FAIL OPEN: a non-Bash tool, no git repo, no banlist, no title or body, an unreadable body file (a readable title is still checked),
+bad stdin, a missing `grep` or `git`, or any error allows. Register it WITHOUT `|| true`, which would turn the deny into an allow. Opt
+out for a session or a project with `PERUN_PRIVACY_GUARD=off` (settings `env`; a `VAR=off` prefix on the command never reaches a hook).
+Side effects: read-only `git rev-parse` and `git remote get-url`, `grep` and file reads; no network. Test: scripts/test_privacy_guard.py.
+"""
+import json
+import os
+import re
+import subprocess
+import sys
+
+HERE = os.path.dirname(os.path.abspath(__file__))
+SHOWN = 5  # hits named in the deny reason
+SELF_REPO = "protocol/perun"  # lower case; same constant as contribution/scripts/prefile_check.sh
+# A repository a write names: `-R`/`--repo OWNER/REPO` (quoted, or with a github.com host), a github.com URL, or a REST path `repos/OWNER/REPO/issues`.
+TARGETS = re.compile(r"(?:(?<![\w-])(?-i:--repo[ =]+|-R[ =]*)[\"']?(?:github\.com/)?|https?://github\.com/|git@github\.com:)([\w.-]+)/([\w.-]+)"
+                     r"|\brepos/([\w.-]+)/([\w.-]+)/(?:pulls|issues)\b", re.I)
+END = re.compile(r"&&|\|\||[;|]|(?<!\\)\n|(?<=\s)#")  # the end of a command line: a separator, a newline that is not escaped, a comment
+
+
+def _git(cwd, *args):
+    try:
+        r = subprocess.run(["git", "-C", cwd or ".", *args], capture_output=True, text=True, timeout=5)
+    except (OSError, subprocess.SubprocessError):  # no git, or too slow: nothing to read, so the caller allows
+        return ""
+    return r.stdout.strip() if r.returncode == 0 else ""
+
+
+def patterns(cwd):
+    """The actionable banlist lines (the rule of ci-gates.sh collect_patterns), .banlist.txt then .banlist.local.txt; [] outside a repo."""
+    top = _git(cwd, "rev-parse", "--show-toplevel")
+    if not top:
+        return []
+    local, common = os.path.join(top, ".banlist.local.txt"), _git(cwd, "rev-parse", "--path-format=absolute", "--git-common-dir")
+    if common and not os.path.isfile(local):  # gitignored, so a linked worktree lacks it: use the main checkout's
+        local = os.path.join(os.path.dirname(common), ".banlist.local.txt")
+    out = []
+    for f in (os.path.join(top, ".banlist.txt"), local):
+        try:
+            with open(f, encoding="utf-8", errors="replace") as fh:
+                out += [s for s in (ln.lstrip() for ln in fh.read().split("\n")) if s and not s.startswith("#")]
+        except OSError:
+            pass
+    return out
+
+
+def scan(text, pats):
+    """[(line number, pattern number)] for each pattern that matches a line of `text`: one `grep -E` per pattern, as the privacy gate runs it."""
+    if not text or not pats:
+        return []
+    data = text.encode("utf-8", "replace")
+
+    def grep(*args):
+        return subprocess.run(["grep", "-aE", *args], input=data, capture_output=True, timeout=10)
+
+    if grep("-q", *[a for p in pats for a in ("-e", p)]).returncode == 1:  # 1: no pattern matches, so there is nothing to locate
+        return []
+    hits = []
+    for i, p in enumerate(pats, 1):
+        r = grep("-n", "-e", p)
+        if r.returncode == 0:  # 1: no match; 2: an invalid ERE, skipped
+            hits += [(int(n), i) for n in re.findall(rb"^(\d+):", r.stdout, re.M)]
+    return hits
+
+
+def _origin(cwd):
+    """(owner, name), lower case, of the session's `origin` remote, or None when there is none, it is unparsable or it is SELF_REPO itself."""
+    m = re.search(r"([^/:\s]+)/([^/:\s]+?)(?:\.git)?/?$", _git(cwd, "remote", "get-url", "origin"))
+    return None if not m or "/".join(m.groups()).lower() == SELF_REPO else tuple(g.lower() for g in m.groups())
+
+
+def _own_names(cwd, origin=None):
+    """Regex for the names of the session's own repository, read from its `origin` remote (or given as `origin`), or None when there is
+    no usable `origin` or the session is in SELF_REPO itself. Matches `owner/name`, and the bare name when it is distinctive;
+    case-insensitive, whole word."""
+    o = origin or _origin(cwd)
+    if not o:
+        return None
+    # ponytail: the bare name counts only when distinctive (it holds - _ . or has 8+ characters). A short plain name (`app`, `api`) is an
+    # ordinary word and would deny normal text, so it is caught only as owner/name. Upgrade: a list of the session's own words (org, package).
+    names = ["/".join(o)] + ([o[1]] if re.search(r"[-_.]", o[1]) or len(o[1]) >= 8 else [])
+    return re.compile(rf"(?<!\w)(?:{'|'.join(map(re.escape, names))})(?!\w)", re.I)
+
+
+def _sibling(target, origin):
+    """True when `target` ("owner/name") is another repository of the origin's owner; SELF_REPO never is."""
+    return target.split("/")[0] == origin[0] and target not in ("/".join(origin), SELF_REPO)
+
+
+def _try(fn, *args):
+    try:
+        v = fn(*args)
+    except (OSError, ValueError, AttributeError):  # unreadable file, non-JSON data
+        return ""
+    return v if isinstance(v, str) else ""
+
+
+def _targets(G, tail, after, end, texts):
+    """The `owner/name` (lower case) of each repository a write names in its own region: `tail` (the command text from the write on)
+    up to offset `end`, the next write, or to the end of its command line found after offset `after`, the end of the write's own match.
+    A heredoc body, a quoted string that holds a space and a one-word title or body are blanked first: text only mentions a repository."""
+    plain = G._plain(tail, lambda s: not re.search(r"\s", s))  # a quoted `-R "o/r"` or URL has no space and stays
+    cut = END.search(plain, after)
+    plain = plain[:max(after, min(end, cut.start() if cut else end))]
+    for t in texts:
+        if t and len(t) < 400 and len(t.split()) == 1:  # whole word only: a title `t` must not eat the `t` of `protocol/perun`
+            plain = re.sub(rf"(?<![^\s\"'=]){re.escape(t)}(?![^\s\"'])", " ", plain)
+    return [re.sub(r"\.git$", "", f"{a or c}/{b or d}".lower()) for a, b, c, d in TARGETS.findall(plain)]  # a clone URL ends in .git
+
+
+def outgoing(cmd, cwd):
+    """[(targets, title, body)] for each covered GitHub write in `cmd`, `targets` being the repositories it names (see `_targets`); ""
+    stands for a part that is absent or unreadable, and [] for no write. A body file the command writes itself reads as the heredoc that
+    feeds it."""
+    sys.path.insert(0, HERE)
+    import comms_guard as G
+    disk, out = G._read, []
+
+    def read(path, cwd):  # the command writes this file itself: the disk holds an old copy or none, so read the heredoc that feeds it
+        lines = {cmd.rfind("\n", 0, w.start()) for w in re.finditer(rf"(?:>>?|\btee\s+(?:-\S+\s+)*)\s*[\"']?{re.escape(path)}[\"']?(?=[\s;&|)]|$)", cmd)}
+        if not lines:
+            return disk(path, cwd)
+        return "\n".join(h.group(3) for h in G.HEREDOC.finditer(cmd) if cmd.rfind("\n", 0, h.start()) in lines)  # the heredoc opens on the line of the redirect: `cat > F <<'EOF'`
+
+    G._read = read  # ponytail: patched around the extraction so it stays imported, not copied (one hook process, one command)
+    try:
+        writes = sorted([*G.GH.finditer(cmd), *G.REST.finditer(cmd)], key=lambda m: m.start())
+        for i, m in enumerate(writes):
+            tail = cmd[m.start():]
+            if m.re is G.GH:
+                title = _try(lambda: next((G._value(r, cwd) for r in G._flags(tail, r"--title|-t")), None))
+                body = _try(G._gh_body, tail, m.group(1), cwd)
+            else:
+                title, body = _try(G._rest_field, tail, cwd, "title", True), _try(G._rest_field, tail, cwd, "body", True)
+            end = writes[i + 1].start() - m.start() if i + 1 < len(writes) else len(tail)
+            out.append((_targets(G, tail, m.end() - m.start(), end, (title, body)), title, body))
+    finally:
+        G._read = disk
+    return out
+
+
+def _named(hits):
+    """The first SHOWN hits joined by `; `, then how many more there are."""
+    return "; ".join(hits[:SHOWN]) + (f"; {len(hits) - SHOWN} more" if len(hits) > SHOWN else "")
+
+
+def verdict(cmd, cwd):
+    """(exit code, stderr text) for one Bash command: 2 and a reason without the matched text or the session repo's name when a title or
+    body line matches the banlist (a write to a sibling repository of the origin's owner is not scanned) or, in a write to SELF_REPO,
+    names the session's own repository."""
+    if not re.search(r"\b(?:gh|curl)\b", cmd):
+        return 0, ""
+    writes = [w for w in outgoing(cmd, cwd) if w[1] or w[2]]
+    if not writes:
+        return 0, ""
+    pats = patterns(cwd)
+    origin = _origin(cwd) if any(w[0] for w in writes) else None  # no usable origin: every write is scanned and there is no own-repository rule
+    names = _own_names(cwd, origin) if origin else None
+    ban, own = [], []
+    for targets, title, body in writes:
+        if not (origin and targets and all(_sibling(t, origin) for t in targets)):
+            ban += [("title", i) for _, i in scan(title, pats)] + [(f"body line {n}", i) for n, i in scan(body, pats)]
+        if names and SELF_REPO in targets:
+            own += (["title"] if names.search(title) else []) + [f"body line {n}" for n, ln in enumerate(body.split("\n"), 1) if names.search(ln)]
+    msg = []
+    if ban:
+        msg.append("Blocked: the title or body of this GitHub write matches the repo banlist (matched text withheld): "
+                   f"{_named([f'{where} (pattern {i})' for where, i in dict.fromkeys(ban)])}. Remove or reword that text and send it again. "
+                   "Patterns are numbered over the actionable lines of .banlist.txt, then .banlist.local.txt.")
+    if own:
+        msg.append(f"Blocked: this write to {SELF_REPO} names the session's own repository (name withheld): {_named(list(dict.fromkeys(own)))}. "
+                   "Reword that text without the repository's name and send it again.")
+    return (2, " ".join(msg)) if msg else (0, "")
+
+
+def main():
+    if os.environ.get("PERUN_PRIVACY_GUARD", "").lower() in ("off", "0", "false"):
+        return 0
+    try:
+        data = json.load(sys.stdin)
+        if data.get("tool_name") != "Bash":
+            return 0
+        code, msg = verdict(str((data.get("tool_input") or {}).get("command") or ""), str(data.get("cwd") or ""))
+    except Exception:  # fail open: a broken privacy hook must never block work
+        return 0
+    if msg:
+        print(msg, file=sys.stderr)
+    return code
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/.claude/skills/agentic-delivery/templates/operating-layer.settings.json b/.claude/skills/agentic-delivery/templates/operating-layer.settings.json
index 9e2068146..a86c246e3 100644
--- a/.claude/skills/agentic-delivery/templates/operating-layer.settings.json
+++ b/.claude/skills/agentic-delivery/templates/operating-layer.settings.json
@@ -99,6 +99,16 @@
           }
         ]
       },
+      {
+        "matcher": "Bash",
+        "hooks": [
+          {
+            "type": "command",
+            "timeout": 10,
+            "command": "python3 \"$CLAUDE_PROJECT_DIR/.claude/skills/agentic-delivery/scripts/privacy_guard.py\""
+          }
+        ]
+      },
       {
         "matcher": "Bash",
         "hooks": [
diff --git a/.claude/skills/deep-code-review/INDEX.md b/.claude/skills/deep-code-review/INDEX.md
index 4f88105bc..4194e55d4 100644
--- a/.claude/skills/deep-code-review/INDEX.md
+++ b/.claude/skills/deep-code-review/INDEX.md
@@ -98,7 +98,7 @@ Generated by `scripts/skill_index.py` (do not hand-edit; rerun it after changing
 | `references/method-diff.md` | the review scope is a DIFF or FILE (a large or blast-radius-flagged DIFF, a fix that is itself the… | 1968 |
 | `references/method-lenses.md` | method.md routes here: a call site may bypass or re-derive a shared helper, component or predicate,… | 1935 |
 | `references/method-report.md` | writing the Phase 5 report (delivery shape, out-of-tree vs in-repo, ledger and claim reconciliation… | 2292 |
-| `references/method-situational.md` | method.md routes here (its "Situational Phase 1 checks" bullet and its perceived-absent-premise par… | 11099 |
+| `references/method-situational.md` | method.md routes here (its "Situational Phase 1 checks" bullet and its perceived-absent-premise par… | 11175 |
 | `references/method.md` | executing a review: after stating SCOPE / START_SHA / COVERAGE_LEDGER, work the phases in order. | 7484 |
 | `references/migration-parity.md` | the reference you are matching is a prototype / mockup / design export (a static page, a design-too… | 7610 |
 | `references/mobile-appsec.md` | the target is (or ships) a native mobile client — an iOS (Swift / Objective-C) or Android (Kotlin /… | 6478 |
diff --git a/.claude/skills/deep-code-review/references/method-situational.md b/.claude/skills/deep-code-review/references/method-situational.md
index b23f478ce..9719be861 100644
--- a/.claude/skills/deep-code-review/references/method-situational.md
+++ b/.claude/skills/deep-code-review/references/method-situational.md
@@ -9,7 +9,7 @@ Read this when `method.md` routes here (its "Situational Phase 1 checks" bullet
   gitleaks, trufflehog (offline, `--no-verification`: unverified; a row is detector, file, line, never the secret), semgrep with the repo's rules or else the bundled taint rules plus p/default (`REVIEW_SEMGREP_REGISTRY=0` drops the registry pack), trivy and osv-scanner offline, osv online with `REVIEW_OSV=1`) on the changed files and prints findings JSON; `--history` scans commit history, `--tests` adds
   the declared `REVIEW_TEST_CMD`; stderr ends with a one-line ran/skipped summary. Its findings are leads: verify
   each against the code before reporting, report a `not run` line or `not-checked` row as unchecked surface, and never read an empty
-  list as clean (analyzers miss fail-open and logic defects). Its gitleaks pass uses `templates/gitleaks.toml`
+  list as clean (analyzers miss fail-open and logic defects). In diff mode every row carries `"new": true|false` (true when its file and line are on a line the diff adds; line 0 and file-level rows are false; `--full` and `--history` omit the key): verify new rows first, and report a pre-existing row in a touched file only when the diff makes it reachable or worse. Its gitleaks pass uses `templates/gitleaks.toml`
   (default rules plus a skip list for `.history/`, `fixtures/`, `testdata/` and generated registry JSON and lockfiles; the skip count is printed) when the repo has no `.gitleaks.toml`. An optional repo-root `.gitleaks-allow` (`rule path-glob sha256-of-secret` per line, format in the template) drops known false positives by content hash, so it survives history rewrites; it is read from the base ref only, and a malformed list is ignored with a warning. **Verify or drop every scanner lead:** open the
   cited line, confirm the code is reachable and, for a secret, that a real value is present (a name like
   `api_key` or `*_key` with no value, a placeholder or a fixture is not a secret); drop what fails; report
diff --git a/.claude/skills/deep-code-review/scripts/review_checks.sh b/.claude/skills/deep-code-review/scripts/review_checks.sh
index 9a18bce43..6675afe7b 100755
--- a/.claude/skills/deep-code-review/scripts/review_checks.sh
+++ b/.claude/skills/deep-code-review/scripts/review_checks.sh
@@ -3,6 +3,7 @@
 # changed since REF (default origin/main, compared as REF...HEAD) and print findings as a JSON array on
 # stdout: [{"file","line","rule","message","text","tool"}]. `text` ("rule: message") is the key
 # scripts/score_review.py matches on. Findings are LEADS: verify each against the code before reporting.
+# Diff mode (not --full or --history) adds "new": true|false to every row: its file+line is on a line REF...HEAD adds (rename-aware; line 0 and file-level rows are false). No row is ever dropped.
 #
 # Tools (linters, gitleaks, trufflehog, osv-scanner, semgrep, trivy): see references/method-situational.md. Each runs only when
 # installed and only on matching changed files. Secrets are redacted and never printed; trufflehog runs offline (`--no-verification --no-update`) over the changed files (every tracked file under --full),
@@ -846,7 +847,10 @@ if [ "$tests" = 1 ]; then
 fi
 
 r=; for t in $ran; do case " $failed " in *" ${t%%(*} "*) ;; *) r+=" $t" ;; esac; done; ran=$r
-REVIEW_STATE="$(git rev-parse --git-common-dir)/review-checks-last.json" HERE="$here" python3 - "$raw" "$ran" "$missing" "$nex" "$dg" "$w1" "$nice19" "$wired" "$gap" "$wiredx" <<'PY'
+# "new" flags, diff mode only (a --full or --history row may sit on a line no diff added). Flags are pinned so user git config cannot change the parse:
+# --inter-hunk-context=0 and --no-color keep hunk counts and headers exact, the prefixes fix the "+++ b/" name, and -a gives a text file with a NUL byte (invisible-chars rows) hunks instead of "Binary files differ".
+ud=; if [ "$wr" = 0 ] && [ "$hist" = 0 ]; then ud=$td/udiff; git -c core.quotePath=false diff -U0 --inter-hunk-context=0 -M -a --no-color --no-ext-diff --no-textconv --src-prefix=a/ --dst-prefix=b/ "$base"...HEAD >"$ud" || ud=; fi
+REVIEW_STATE="$(git rev-parse --git-common-dir)/review-checks-last.json" HERE="$here" python3 - "$raw" "$ran" "$missing" "$nex" "$dg" "$w1" "$nice19" "$wired" "$gap" "$wiredx" "$ud" <<'PY'
 import json, os, re, shlex, sys, time
 rows = [l.rstrip("\n").split("\t") for l in open(sys.argv[1], encoding="utf-8", errors="replace")]
 rows = [t for i, t in enumerate(rows) if t[3:4] != ["not-checked"] or t not in rows[:i]]  # a tool failing on N files is one not-checked row
@@ -882,6 +886,17 @@ for t in data:
     k = key(t)
     if not k or len(groups[k]) <= 3: out.append(row(t))
     elif k not in done: done.add(k); out.append(summ(k, groups[k]))
+ud = sys.argv[11]  # `git diff -U0` of BASE...HEAD; "" under --full/--history (no "new" key)
+if ud:
+    adds, cur, inh = {}, None, False  # adds: file -> [(first line, count)] of added lines; cur: the file whose hunks are being read; inh: past its first hunk header, where a "+++ " line is content
+    for l in open(ud, encoding="utf-8", errors="replace"):
+        if l.startswith("diff --git "): cur, inh = None, False
+        elif l.startswith("@@ "):
+            inh = True; m = re.match(r"@@ -\S+ \+(\d+)(?:,(\d+))? @@", l)
+            if cur and m: adds[cur].append((int(m[1]), 1 if m[2] is None else int(m[2])))  # "+N" is one line, "+N,0" none
+        elif not inh and l.startswith("+++ b/"): cur = l[6:].rstrip("\n").split("\t")[0]; adds[cur] = []  # git adds a tab after a name with a space; a quoted name or /dev/null leaves cur unset
+    for r in out:  # file-level rows (line 0, no file) are never new; every other path is read relative to the repo root, as the tools print it ("./x", absolute)
+        r["new"] = r["line"] > 0 and r["file"] not in ("", "-") and any(a <= r["line"] < a + c for a, c in adds.get(os.path.relpath(r["file"]), ()))
 print(json.dumps(out, indent=1))
 n = len(out)
 dg, w1 = sys.argv[5].split(), sys.argv[6].split()  # lease full: "1 worker" only for tools whose single-worker flag ran; "nice 19" only when nice worked
@@ -889,6 +904,7 @@ def lab(t):
     b = t.split("(")[0]
     return t + (f" (degraded: lease full{', nice 19' if sys.argv[7] == '1' else ''}{', 1 worker' if b in w1 else ''})" if b in dg else "")
 print(f"review_checks: {n} findings; {sys.argv[4]} files excluded; analyzers ran: {', '.join(lab(t) for t in sys.argv[2].split()) or 'none'}; skipped (not installed): {', '.join(sys.argv[3].split()) or 'none'}", file=sys.stderr)
+if ud: print(f"review_checks: {sum(r['new'] for r in out)} of {n} rows are on lines this diff adds", file=sys.stderr)
 # "ran X / wired Y": wired = scanners with work in this run (their files matched); fixable = wired and either missing or running without a cache a provision warms.
 # argv[10] (shellcheck, ruff/pyflakes, gitleaks-history) is wired too, but provision_tools.sh cannot install it, so it is never fixable.
 wired = sys.argv[8].split()
diff --git a/SHA256SUMS b/SHA256SUMS
index 563429640..37eb223a4 100644
--- a/SHA256SUMS
+++ b/SHA256SUMS
@@ -18,8 +18,8 @@ ef9e423362b12d0dd73c8e165faf32e9f53c4d4ac215b57c2e34002a88713838  .claude/skills
 71def6259e7016301932ac474dd4b7afea29349a8dd0b6284d74b5e9ebd16936  .claude/skills/agentic-ceo/scripts/token_ratchet.py
 372f7d86157392ebfab627f6a05a892e4dd3297db9b8bfc6f404759169c7500c  .claude/skills/agentic-ceo/scripts/token_report.py
 9521b057ff3db92d1e60923ebd88170713914f7e235ceb45717eb39419daf811  .claude/skills/agentic-ceo/scripts/weekly_receipt.py
-001b7b0a350ff5b7d4e5b85ca2bc6060514410377461a4def7579a92ab7f187a  .claude/skills/agentic-delivery/INDEX-scripts.md
-29ffa479167c28a166aa0fe2cf189bb12335186256e391eccec68208fd5b36a0  .claude/skills/agentic-delivery/INDEX.md
+7e2179751e9dd2fb371b3e9fb01fca987d69605af1e8e6e609ff9b0d0abb384b  .claude/skills/agentic-delivery/INDEX-scripts.md
+47fff02dcb4401d5a9b42b2b3b7f7c123125eece55e7f9adee8cfe488c70a146  .claude/skills/agentic-delivery/INDEX.md
 04982647fd4125802d46d991ca23ce7fa648a6b2b71074ebbf2c71e6d483619e  .claude/skills/agentic-delivery/SKILL.md
 73e93e5ff760a52ccc7044d782e1db000a421b043567d8de6ed00a922ffc5959  .claude/skills/agentic-delivery/VERSION
 94144c101f82399eb6c18f688321a00e1c195dd0ab334f3a5daa2543b40ff9f5  .claude/skills/agentic-delivery/evals/evals.json
@@ -68,7 +68,7 @@ a6fc31cf16e20c1b3107b832c1c65b766984199fd64d5cc0937df88951183e69  .claude/skills
 0193bc266dd2726b6b370e7d733fe7cdda33ebdf650748d561c9e6f8a311b8e0  .claude/skills/agentic-delivery/scripts/claim_probe.py
 03af48a629587a7d5d826a84420373bd3bfce9f96097a1eea09bb3656d2b3359  .claude/skills/agentic-delivery/scripts/clean_finished.sh
 264713d1667dd51c08ab3646450a5da198eda83f28f8f5705275e911cb3ee9b8  .claude/skills/agentic-delivery/scripts/clock_lint.py
-3b6d6832f55540575c6a6e9840670c255b6e7d4ec25ab22ce5058f0b7761c523  .claude/skills/agentic-delivery/scripts/comms_guard.py
+8aeadfe6f80dc66cb2ac5984c48d407e23e01679b045e263ec5350112febec76  .claude/skills/agentic-delivery/scripts/comms_guard.py
 825a6881cf342d50f8ad8bb4dd78eb2403e8cfe1dec94c64adf0ed61f55fcd44  .claude/skills/agentic-delivery/scripts/context_nudge.py
 bb340c0138e40e403e2832f11b59199cf9e3427ffab9e18fcffd69f0e227fd6a  .claude/skills/agentic-delivery/scripts/cost_statusline.py
 703423ad6921f7dd2ca3f41c6f72adbcd16a07da3df18f205f11a07d479c7207  .claude/skills/agentic-delivery/scripts/decision_gate.py
@@ -126,6 +126,7 @@ a9235428a933257a45cc486a58dffe4f8ec5a398311937c887066aa0e0698162  .claude/skills
 6543ba858ea5e599d12ac8b7fc4cb56919d28ea66c521d887f574bb5d1139c11  .claude/skills/agentic-delivery/scripts/premise_check.py
 5e6bf88353f68be4b012cd44742e8bba94db5fd17b246e73b682b9d70577540b  .claude/skills/agentic-delivery/scripts/prevention_lint.py
 3e3045c3d4a695927970cf767569cbf271b4ae30ddd11eb2b2defab880c485bc  .claude/skills/agentic-delivery/scripts/priority_gate.py
+19223509022e7a9c3133c1784643bea0f2bcd010a06f9ab4ef7e6eaf10601710  .claude/skills/agentic-delivery/scripts/privacy_guard.py
 9eaf96f25ab91db9fde36ee43bd2a85f0fb422107f92cecfada96aafe1b62af3  .claude/skills/agentic-delivery/scripts/queue_guard.py
 df84be6c5c868d26b90c34ba720e87407f63bc259dbabfb30ae41789dfb5da63  .claude/skills/agentic-delivery/scripts/reap_own.sh
 d9135da4b8af3e2aacc5de5edb28843d6370ced0185860f49afc5eca9918987f  .claude/skills/agentic-delivery/scripts/red_main.py
@@ -169,7 +170,7 @@ ac7eb14ad5aa0add90a39d2f6d1f8ab1d53763b4912e13916f788cdd30a1d0c2  .claude/skills
 c3ef87aa65dec1f63df5f6b1aadc3a1e5c322ed7288a5dbd3b7617d56c12adbb  .claude/skills/agentic-delivery/templates/loops/cleanup.md
 b956a4767c55179e732c5e34581abfd07b285dd73aa030ad9119005cb8e2d0a2  .claude/skills/agentic-delivery/templates/loops/coordinator.md
 7f5e043836dca83534623994d97de0da88caec290e434d0c7a1a52cf2345f05b  .claude/skills/agentic-delivery/templates/loops/peer.md
-59507ff96d89724b022dee7234906c0af218655dbbdabd6f4f41493effc82607  .claude/skills/agentic-delivery/templates/operating-layer.settings.json
+7fa1d9aa98581763f73f661b2ae46a5246ea6ecef54ea717c34be2603fea0ff7  .claude/skills/agentic-delivery/templates/operating-layer.settings.json
 024c151cdc8b5175a25ebe44cf4cbb86539ae8d9f90e03b7e2ac359481841681  .claude/skills/agentic-delivery/templates/review-tiers.tsv
 0a250e0345c762cbcd7ac018c161bc9a11b405fed644c936379fb74881cc5025  .claude/skills/agentic-delivery/templates/terse-replies.settings.json
 986cd7d948bb0aea7abbaa89931756e68b63f48d6fc0fccb00a8e070e618ec6d  .claude/skills/business-ops/INDEX.md
@@ -204,7 +205,7 @@ d98f3e4380da3496061ba63be7beebe75017ab4ee1734eda9a3e798e19007b0e  .claude/skills
 92d22cc5d0a60ba6bdb1f4a9b597823dec5b8412cec09a5be6cf93b3973f4226  .claude/skills/contribution/scripts/prefile_check.sh
 18f20db537ab784460ad33cf218f7a01ac0a172fc38413f14c0e19e1ce6821cc  .claude/skills/contribution/scripts/share_learning.py
 63e7d07ffa54b224a83abee280456f6a24dc8222b9b55f6e249b10ea0c7f5afc  .claude/skills/deep-code-review/INDEX-scripts.md
-848ddf8c618da617b98bbe76808e775e6ef4f25ccc71954a868a093411d5e9d4  .claude/skills/deep-code-review/INDEX.md
+3145a0f11e8ecc8b510ae32e7de8eff9bea24e1e9bf46ed662221b7b4d386de2  .claude/skills/deep-code-review/INDEX.md
 a44ec08c8bd85b4adb4ce9c18e01e8c01a500f6efaceaf4bc79e2c396f4393d3  .claude/skills/deep-code-review/SKILL.md
 73e93e5ff760a52ccc7044d782e1db000a421b043567d8de6ed00a922ffc5959  .claude/skills/deep-code-review/VERSION
 b97d95bc93cc23a8bc689e2e23db261a138367bcbc69d2f8a0452d5c2c6dfb68  .claude/skills/deep-code-review/evals/evals.json
@@ -301,7 +302,7 @@ cfdc3609c63b7669dd0ddcab3546dbae6036e5214668802acfb0cfc9117a8f25  .claude/skills
 712ff4adad24308045101ee386340a61dd80230ddcbdedc30603d18b412378d3  .claude/skills/deep-code-review/references/method-diff.md
 1c428659366bb21fad34ab66f42390410dbf5191d97c07ca40db8b0476081fa2  .claude/skills/deep-code-review/references/method-lenses.md
 43ce8532a5f85d5784bcfd1d052ed6d7e832902602d2f7e5e8c4fafebef0b8e2  .claude/skills/deep-code-review/references/method-report.md
-77b2176d240a480e43fa11d93098e551ff9af49c25459a0fb22d07b64b645e02  .claude/skills/deep-code-review/references/method-situational.md
+9a97de6c253d9d39bfa108c0608dfc6ff820abbad64e9d5b6362695d472ea8d4  .claude/skills/deep-code-review/references/method-situational.md
 fd354313f768db8a13a99e4012379a2c75f804a120c8e2de8556a8cac3981742  .claude/skills/deep-code-review/references/method.md
 5fd086a47f860ab2b946d9409d1e1de03b1338cf832d5f1539fb3dfe63d85001  .claude/skills/deep-code-review/references/migration-parity.md
 17838a58489145ecb8a466737ae5e12ac37e98260d335d160aff95d3d5354804  .claude/skills/deep-code-review/references/mobile-appsec.md
@@ -396,7 +397,7 @@ e2903a566deee3423cc377b000475b30d6698ccebd640cb62b86b6d2001c4822  .claude/skills
 5d6910164ddf6dfd4ed62dfc365a2f615f49dc07878ed3d1f881aa9518e481c2  .claude/skills/deep-code-review/scripts/post_review.sh
 b01cae69d80ca560cc414c1c70ef0ddfdbb910da5b68df4e9d46cf0daf3f8b16  .claude/skills/deep-code-review/scripts/provision_tools.sh
 f1108e2700864195a239744b319b1d04953879589f8a2b83708bc45a080e3d86  .claude/skills/deep-code-review/scripts/reaper_lint.py
-4e7ff3d05f56d8e81864ba434bf4e9adfa3dc4243cef01a4d06bf0e0260d6314  .claude/skills/deep-code-review/scripts/review_checks.sh
+6315b222c3993981e09b9b608502b71b055cbee6ef4819b3e5dc6293029b0c7d  .claude/skills/deep-code-review/scripts/review_checks.sh
 8c87c02a050a975e453b52ecacbaf01481c7134466a9c67feaf409d22e36d9f7  .claude/skills/deep-code-review/scripts/review_feedback.py
 859c67d6a6a781c873f47d5662d403da2321da53e6994ca3d0ccdbf74afd39ac  .claude/skills/deep-code-review/scripts/score_review.py
 e9dfa337ad16d0022a3b7a87e0ba49acb5c2c9c0a5ee24396ff80523f2f8fa1a  .claude/skills/deep-code-review/scripts/security_verify.py
diff --git a/changelog.d/guard-registry.md b/changelog.d/guard-registry.md
new file mode 100644
index 000000000..6e099946c
--- /dev/null
+++ b/changelog.d/guard-registry.md
@@ -0,0 +1,7 @@
+### Added
+- `scripts/guard-registry.tsv`: one row per hook a shipped template runs or `install.sh` writes and per `ci-gates.sh` gate, with columns `id`, `owner`, `reason`, `review-by` and an optional fire log path. A guard is a hook script a shipped `.claude/skills/*/templates/*.settings.json` runs (`hook:<skill>/<script>`), a git hook `install.sh` writes (`hook:.githooks/<name>`), or a `ci-gates.sh` subcommand (`gate:<name>`). A script no template wires (a CI-only gate script, a hook the owner installs by hand) has no row; `ci-gates.sh rails` still covers its `# rail:` header. The owner is a lowercase role slug (`release-owner`), never a person; `Jane Smith`, an email and an `@handle` are rejected.
+- `ci-gates.sh guard-registry --registry <file> <root>`: fails closed when a guard has no row, a row has an empty reason, an owner that is not a role slug, or a `review-by` that is not a real `YYYY-MM-DD` date, when a guard has two rows or a row has more than five columns, and when a row names a guard that no longer ships. It also fails when the root has no hook or gate to check, and when `ci-gates.sh` defines a `cmd_` function whose dispatcher line the scan cannot read, so an empty or blind scan cannot pass. A review date in the past never fails the gate; the report below surfaces it. The test below runs it on the real registry on every PR.
+- `ci-gates.sh guard-registry --report [--days N] ...`: a read-only list for the owner to confirm. It shows rows past `review-by`, and guards whose fire log has no dated line inside the last N days (default 30). A guard with no fire log, or whose log is missing, unreadable, emptied or holds no dated line, is reported as `unknown`, never as zero fires. It runs the gate first, never deletes or edits a row, and opens every file read-only. Today only `reply_cap.py` has a fire log (`~/.cache/perun/reply-cap.log`, one dated line per block), so it is the one row with a fifth column. That cell names the default location only: `REPLY_CAP_LOG` or `XDG_CACHE_HOME` moves the log, and the report then reads the wrong file.
+- `scripts/test-guard-registry.sh` (registered in `scripts/ci-tests.d/guard-registry.sh`): one case per failure mode above, the fail-closed and argument errors, the report's window, `unknown`, `~` expansion and read-only behaviour, and the real registry (row counts, the `reply_cap` log path, and each hook row's owner, reason and review date equal to its script's `# rail:` header).
+
+Decision record: the `# rail:` headers from `ci-gates.sh rails` stay, because they also cover non-hook gate scripts that this registry does not list. Hook rows therefore repeat the header's owner, reason and review date, and the test fails if the two drift apart. If they still disagree after about 30 days, retire one of the two; the follow-up is to let `rails` accept a registry row in place of a header.
diff --git a/changelog.d/privacy-guard.md b/changelog.d/privacy-guard.md
new file mode 100644
index 000000000..da727c587
--- /dev/null
+++ b/changelog.d/privacy-guard.md
@@ -0,0 +1,13 @@
+### Added
+- `.claude/skills/agentic-delivery/scripts/privacy_guard.py`: a PreToolUse(Bash) hook that denies (exit 2) a GitHub write whose title or body matches the repo's banlist. Nothing scanned the text an agent publishes, so a banlisted identifier in an issue or PR body went out unchecked while the privacy gate only read committed files. It covers what `comms_guard.py` covers and reads text through its extraction: `gh pr|issue|release create|edit|comment`, and `curl` or `gh api` calls to `repos/<owner>/<repo>/pulls` or `/issues`, with the title (`--title`/`-t`, `-f title=`, JSON `title`) and the body (`--body`, a heredoc, `$(cat FILE)`, `--body-file`, `-d` or `--input` JSON, `-f body=`, `-F body=@FILE`). `-f`/`--raw-field` text is scanned as typed (gh sends `@jane` as a mention); only `-F`/`--field` reads `@FILE`, and an `@FILE` it cannot read is scanned as typed. Every write in a command is read, not only the first. A body file that the same command writes (`> F`, `>> F`, `tee F`) is read from the heredoc that feeds it, because the disk holds an old copy or none and the command's other heredocs (a `python3 - <<'PY'` script, a `git commit -m "$(cat <<'EOF' ...)"`) are not the body: a clean rewrite is no longer denied for the stale text or an unrelated heredoc, and a banlisted heredoc is no longer missed because the file does not exist yet. The patterns are the actionable lines of `.banlist.txt` then `.banlist.local.txt` at the git top-level of the session directory (a linked worktree falls back to the main checkout's gitignored local file), each run through `grep -E` over each line of the text, as `ci-gates.sh privacy` runs it. The deny reason names the title or the body line number and the pattern's 1-based number among those lines, never the matched text. It fails open: no repo, no banlist, no title or body, an unreadable body file (a readable title is still checked), bad input, a missing `git` or `grep`, or any error allows. Opt out for a session or project with `PERUN_PRIVACY_GUARD=off` in settings `env`. The module docstring lists what it does not cover (merge and review, `--fill`, a body fed to stdin by a pipe, text built from a shell variable, close and reply routes, and other forms). It is registered in the operating-layer template on the Bash matcher without `|| true` (which would turn the deny into an allow), listed in `perun_doctor.py` `HOOK_SCRIPTS`, and has a row in `scripts/guard-registry.tsv`.
+- Scope of the banlist scan. The scan runs on every write except one whose explicit target is a sibling: another repository under the owner of the session's `origin` remote, where a private repository's name belongs. The session's own repository (implicit, or named by `-R`/`--repo`, a github.com URL or a `repos/` path), the Perun repository, every other owner's repository, a write that names no repository and a session with no usable `origin` stay scanned, and a write that names several repositories is skipped only when every one is a sibling. The target is read from the write's own region: from the write to the next `gh` or `curl` write or to the end of its command line (`&&`, `||`, `;`, `|`, a newline or a `#` comment; a backslash-newline continues the line). A `.git` suffix is dropped, so the session repository's clone URL still names the own repository. Heredoc bodies, quoted strings that hold a space and a one-word title or body are blanked first, so text that only mentions a repository (a body quoting `-R acme/other` or naming `repos/acme/other/issues/3`, a later `echo filed https://github.com/...`) sets no target and a write cannot skip the scan by naming a sibling in its text.
+- Own-repository rule in the same hook. A project's banlist does not list the project's own name, so a field report filed from that project's session into the public Perun repository carried the name past the banlist. When a write targets the Perun repository (`SELF_REPO`, by `-R`/`--repo`, a `repos/protocol/perun/` path or its github.com URL, read from the write's own region as above) and the session's `origin` remote names a different repository, a title or body line that names that repository is denied: as `owner/name`, or as the bare name when it is distinctive (it holds `-`, `_` or `.`, or has 8 or more characters), case-insensitive and whole word. The reason gives the location (`title`, `body line N`) and never the name. It needs no network, and a session inside the Perun repository, with no `origin`, or with an unparsable one has no such rule. Reading the target from the write's own region also stops a write that names the session repository from being denied for an unrelated mention of the Perun repository later in the command or in its text.
+- `scripts/test_privacy_guard.py` (40 offline tests on fictional Acme fixtures in throwaway git repos, wired in `scripts/ci-tests.d/privacy-guard.sh`): every write form and every title form is denied without echoing the text, line and pattern numbers (an invalid ERE is skipped, not renumbered), the five-hit cap, POSIX-class and case-sensitive matching through `grep -E`, the linked-worktree fallback, the allow paths (clean text, other commands, no repo, no banlist, an empty banlist, an unreadable body, the opt-out, bad input, another tool), the template and doctor wiring, `-F body=@FILE` followed by more arguments, flag-like words inside a quoted title or body or a heredoc body, every write in a command, a body file the command writes itself (fresh, stale, and beside an unrelated heredoc), `-f` against `-F` for `@`, the own-repository rule (each target form, ssh and https origins, other targets, a Perun session, no origin, short and distinctive bare names, whole-word and case-insensitive matching, both reasons together, a failing `git`), and the scope rule on an acme/acme-widgets session (each sibling target form skipped; the own repository, Perun, another owner, a Perun origin or none, an origin in the Perun organisation and a `-r` reviewer scanned; text that only names a sibling; a sibling write beside an own write; six tail cases that must allow and the controls that must still deny). Twenty-nine mutants of the new code (the sibling skip, the target region and its blanking, `-f` against `-F`, the feeding heredoc, the origin parse) each fail at least one of these tests.
+- `scripts/guard-registry.tsv` and the `# rail:` header of `privacy_guard.py` state the new scope in the same words.
+
+### Changed
+- `comms_guard.py`: `_rest_body(tail, cwd)` is now `_rest_field(tail, cwd, key, literal=False)`, so the title of a REST write is read by the same code as its body. `extract` still returns the body and the existing comms_guard tests pass unchanged. `literal` makes an unreadable `-F body=@FILE` come back as the typed text instead of raising; only `privacy_guard.py` passes it, so the comms lint still treats an unreadable file as no body.
+- `comms_guard.py`: `-F body=@FILE` and `-F 'body=@FILE'` read `@FILE` as one shell word, so more arguments after it (`--jq .id`, `-f title=t`, `&& echo done`) no longer turn the read into a failure and a skipped lint. A flag-like word inside a quoted string or a heredoc body (the title "Add -b flag", a body that mentions `-t`) is no longer read as a flag: `_flags` blanks quoted strings and heredoc bodies (the new `_plain`, which the privacy hook's target region reuses) before it looks for a flag, and an unclosed quote hides nothing. Blanking keeps the raw offsets that the heredoc and `$(cat FILE)` readers need, which a shell tokenizer would not, and it falls back to the earlier first-textual behaviour wherever a quote does not pair.
+- `comms_guard.py`: `@` means a file only for `-F`/`--field`. `-f`/`--raw-field` sends its text as typed, so `-f body='@jane thanks'` and `-f title='@jane ...'` are linted and scanned as written; the first version of this change read them as a missing file and skipped them, and the earlier code read an unquoted `-f body=@FILE` as a file that gh does not read. A comms lint of `-f body=@FILE` now sees the text `@FILE`.
+
+Decision record (evil twin). Skeptic: a deny hook that agents cannot see into will occasionally block a legitimate write, and the secret-shaped patterns here lack the gate's placeholder relaxation. The banlist is the session repo's, so a write into another owner's private repository that names the session project is denied, and a name that is legitimate there must be reworded. Better way: relax secret patterns with `secret_scan.py`'s placeholder rule, ask the network whether the target is private, or skip every write that has `--repo`. All rejected. The relaxation script lives under `scripts/` and is not installed with the skills, so the hook would behave differently per install. A visibility lookup needs the network and a token, which this hook avoids, and a failed lookup must either block or leak. Skipping on any `--repo` would exempt the upstream-contribution flow, where a leak into a public repo matters most; the sibling rule skips only the origin owner's other repositories, so a write into Perun or into another owner's repository stays scanned. Accepted residuals: a public sibling in the origin's organisation is not scanned, so a banlisted identifier written there goes out; another owner's private repository is scanned, so a legitimate name in it is denied (reword it or opt out); a target set by `GH_REPO` is not seen. A blocked line is cheap to reword because the reason names it, and `PERUN_PRIVACY_GUARD=off` is the owner's escape. The own-repository rule trades a missed short bare name (caught only as `owner/name`) for never denying an ordinary word such as `app`; a list of the session's own words is the upgrade if a leak slips through. Kill criterion: two false positives from a secret-shaped pattern, from a write into another owner's repository, or from the own-repository rule in one release means narrow the hook (drop those sections, ship the relaxation, or drop the bare-name match) before it blocks more work, and one banlisted identifier that reaches a public sibling means drop the sibling skip.
diff --git a/changelog.d/review-checks-new-rows.md b/changelog.d/review-checks-new-rows.md
new file mode 100644
index 000000000..b33ab36d8
--- /dev/null
+++ b/changelog.d/review-checks-new-rows.md
@@ -0,0 +1,5 @@
+### Added
+- `review_checks.sh` marks every row `"new": true|false` in diff mode: `true` when the row's file and line are on a line `REF...HEAD` adds, read from `git diff -U0` of the range the script already uses. It is rename-aware, so a renamed file's old lines are not new; line 0 and file-level rows are `false`. `--full` and `--history` omit the key, no row is ever dropped, and stderr gains one line, `review_checks: N of M rows are on lines this diff adds`. A reviewer can start from the rows the change introduced and treat the rest as pre-existing, instead of re-triaging a touched file's whole backlog. The diff flags are pinned (`-U0 --inter-hunk-context=0 -M -a --no-color --no-ext-diff --no-textconv` and explicit `a/` `b/` prefixes) so a reviewer's git config cannot change which lines count as added; `-a` keeps a text file with a NUL byte (an `invisible-chars` row) from reading as `Binary files differ`, which would mark its added lines pre-existing.
+- One sentence in `references/method-situational.md`, where the script's rows are documented for reviewers: verify new rows first, and report a pre-existing row in a touched file only when the diff makes it reachable or worse.
+- `scripts/test-review-checks-new-rows.sh` (16 offline cases, wired in `scripts/ci-tests.d/review-checks-new-rows.sh`): a fake shellcheck on a hermetic PATH, in a repo whose git config is hostile (no rename detection, no prefixes, merged hunks, forced colour, an external diff, a line-dropping textconv). It covers an added line, a pre-existing line shifted down between two hunks, a renamed and edited file, a pure rename, a new file, a line 0 row, a path with a space, a NUL byte, the stderr count, and the missing key under `--full` and `--history`. Each pinned flag has a case that fails without it, and the cases that assert the flag fail on the script before this change.
+size-budget-raise: .claude/skills/deep-code-review/references/method-situational.md 44396→44702 one sentence on the new flag: verify new rows first, report a pre-existing row only when the diff makes it reachable or worse
diff --git a/scripts/ci-gates.sh b/scripts/ci-gates.sh
index a9549cf32..6771d051c 100644
--- a/scripts/ci-gates.sh
+++ b/scripts/ci-gates.sh
@@ -26,6 +26,8 @@
 #   tests-wired --allowlist <file> <root>
 #                                        every scripts/test_*.py and scripts/test-*.sh is run by CI (named in scripts/ci-tests.d/*.sh, .github/workflows/*.yml or a test they run) or listed in <file> with a reason; a stale row FAILS
 #   rails [--audit] <root>               every guard/hook script (name ends _guard/_gate/_cap/_hook, or a hook template wires it) carries `# rail: owner=..., why=..., review=YYYY-MM-DD`; a missing or empty field or a bad date FAILS; --audit lists rails past their review date (never removes one)
+#   guard-registry --registry <file> [--report [--days N]] <root>
+#                                        every hook a shipped template runs or install.sh writes under .githooks/, and every subcommand here, has one row (owner role, reason, review-by date) in <file>; a missing row, an empty reason, a bad date or a row for a guard that is gone FAILS; --report (read-only) lists rows past review-by and guards with no fire in N days, `unknown` where there is no fire log
 #
 set -euo pipefail
 
@@ -83,6 +85,7 @@ Usage:
   ci-gates.sh mustload --config <file> <root>
   ci-gates.sh tests-wired --allowlist <file> <root>
   ci-gates.sh rails [--audit] <root>
+  ci-gates.sh guard-registry --registry <file> [--report [--days N]] <root>
 EOF
 }
 
@@ -1738,6 +1741,130 @@ if audit:
 PY
 }
 
+# ---------------------------------------------------------------------------
+# guard-registry — every installed hook and every gate has one row in one TSV (#1592).
+#
+# <file> (scripts/guard-registry.tsv) holds `<id><TAB><owner role><TAB><reason><TAB><review-by YYYY-MM-DD>[<TAB><fire log>]`; `#` comments and
+# blank lines are ignored. A guard is a hook script a shipped .claude/skills/*/templates/*.settings.json runs (id `hook:<skill>/<script>`),
+# a git hook install.sh writes under .githooks/ (id `hook:.githooks/<name>`), or a subcommand of this file (id `gate:<name>`). The gate FAILS on a
+# guard with no row, an empty reason, an owner that is not a lowercase role slug (so an email, a "First Last" or an @handle is refused; a bare
+# username is not caught), a review-by that is not a real calendar day, a duplicate row, or a row for a guard that no longer exists (delete
+# it), so the table stays exactly the set that ships. A review-by in the past does NOT fail the gate (that would break every PR on one day).
+# `--report [--days N]` is the read-only owner view (default N=30; run it on the machine whose logs matter): rows past review-by, and guards
+# whose fire log (optional 5th column: a path, `~` and $VARs expanded, one `YYYY-MM-DD ...` line per fire) holds no line dated in the last N
+# days. A guard with no fire log, or whose log is missing or holds no dated line, is `unknown`, never "zero fires". It opens the registry and
+# the logs for reading only and never edits or deletes a row; the owner confirms (bumps review-by) or retires.
+# It also FAILS on a `cmd_*` function with no dispatcher line of the shape `name) cmd_x "$@" ;;`, so a new gate cannot dodge the scan.
+# Limit: a script no template wires (a CI-only gate script, a hook the owner wires by hand) is not a guard here; `rails` covers headers.
+# The regression test is scripts/test-guard-registry.sh.
+# ---------------------------------------------------------------------------
+cmd_guard_registry() {
+  local reg="" root="" report=0 days=30
+  while [ "$#" -gt 0 ]; do
+    case "$1" in
+      --registry) [ "$#" -ge 2 ] || die "guard-registry: --registry needs a value"; reg="$2"; shift 2 ;;
+      --report) report=1; shift ;;
+      --days) [ "$#" -ge 2 ] || die "guard-registry: --days needs a value"; days="$2"; shift 2 ;;
+      -*) die "guard-registry: unknown option: $1" ;;
+      *) [ -z "$root" ] || die "guard-registry: unexpected extra argument: $1"; root="$1"; shift ;;
+    esac
+  done
+  [ -n "$reg" ] && [ -n "$root" ] || die "guard-registry: --registry <file> and <root> are required"
+  [[ "$days" =~ ^[1-9][0-9]{0,4}$ ]] || die "guard-registry: --days wants a whole number from 1 to 99999, got: $days"
+  [ -f "$reg" ] || die "guard-registry: registry not found: $reg (fail closed)"
+  [ -d "$root/.claude/skills" ] || die "guard-registry: $root/.claude/skills not found (fail closed)"
+  [ -f "$root/scripts/ci-gates.sh" ] || die "guard-registry: $root/scripts/ci-gates.sh not found (fail closed)"
+  [ -f "$root/install.sh" ] || die "guard-registry: $root/install.sh not found (fail closed)"
+  python3 - "$reg" "$root" "$report" "$days" <<'PY'
+import datetime, glob, json, os, re, sys
+
+reg, root, report, days = sys.argv[1], sys.argv[2], sys.argv[3] == "1", int(sys.argv[4])
+today = datetime.date.today()
+
+
+def day(s):
+    """A real YYYY-MM-DD calendar day as a date, else None."""
+    try:
+        return datetime.date(*map(int, s.split("-"))) if re.fullmatch(r"[0-9]{4}-[0-9]{2}-[0-9]{2}", s) else None
+    except ValueError:
+        return None
+
+
+skills, wired, guards = root + "/.claude/skills", set(), set()
+pat = glob.escape(skills)  # a root with [ or * in its path must still glob
+for p in glob.glob(pat + "/*/templates/*.settings.json"):  # basenames a shipped hook template runs (the rule `rails` uses)
+    for group in json.load(open(p, encoding="utf-8")).get("hooks", {}).values():
+        for entry in group:
+            for hook in entry.get("hooks", []):
+                wired.update(re.findall(r"[\w.-]+\.(?:py|sh)\b", hook.get("command", "")))
+for name in wired:
+    guards.update(f"hook:{f.split('/')[-3]}/{name}" for f in glob.glob(f"{pat}/*/scripts/{name}"))
+guards.update(f"hook:.githooks/{n}" for n in re.findall(r'write_gate_file\s+"[^"]*"\s+"[^"]*/\.githooks/([\w-]+)"', open(root + "/install.sh", encoding="utf-8").read()))
+gsrc = open(root + "/scripts/ci-gates.sh", encoding="utf-8").read()
+gates = re.findall(r'^\s+([a-z][a-z0-9-]*)\) cmd_\w+ "\$@" ;;\s*$', gsrc, re.M)
+guards.update(f"gate:{n}" for n in gates)
+
+rows, bad = {}, []
+if len(gates) != len(re.findall(r"^cmd_\w+\(\)", gsrc, re.M)):  # a dispatcher line in another shape would let a gate skip its row
+    bad.append('scripts/ci-gates.sh: a cmd_ function has no dispatcher line like `name) cmd_x "$@" ;;` (write it that way so the scan sees it)')
+for no, line in enumerate(open(reg, encoding="utf-8"), 1):
+    if not line.strip() or line.lstrip().startswith("#"):
+        continue
+    f = [c.strip() for c in line.rstrip("\n").split("\t")]
+    if not f[0]:
+        bad.append(f"line {no}: row has no id")
+    elif f[0] in rows:
+        bad.append(f"{f[0]}: duplicate row (line {no})")
+    elif len(f) > 5:
+        bad.append(f"{f[0]}: {len(f)} columns, want id, owner, reason, review-by and an optional fire log")
+    else:
+        gid, owner, why, review, log = (f + [""] * 5)[:5]
+        due = day(review)
+        if not re.fullmatch(r"[a-z][a-z0-9-]*", owner):
+            bad.append(f"{gid}: owner must be a lowercase role slug (a role, never a person), got {owner!a}")
+        if not why:
+            bad.append(f"{gid}: reason must not be empty")
+        if due is None:
+            bad.append(f"{gid}: review-by {review!a} is not a real YYYY-MM-DD date")
+        rows[gid] = (owner, why, due, log)
+bad += [f"{g} is a guard with no row: add `{g}<TAB>owner role<TAB>reason<TAB>review-by` to {reg}" for g in sorted(guards - set(rows))]
+bad += [f"{g}: row names no guard that ships (delete the row)" for g in sorted(set(rows) - guards)]
+if not guards:
+    bad.append("no hook or gate found (fail closed)")
+for b in bad:
+    print("guard-registry: FAIL " + b)
+if bad:
+    sys.exit(1)
+hooks = sum(g.startswith("hook:") for g in guards)
+print(f"guard-registry: ok ({hooks} hooks, {len(guards) - hooks} gates)")
+if report:
+    cutoff = today - datetime.timedelta(days=days)
+
+    def fires(path):
+        """(fires since the cutoff, newest dated line) of a readable log that holds a dated line, else None = unknown (an emptied or rotated log too)."""
+        try:
+            with open(os.path.expanduser(os.path.expandvars(path)), encoding="utf-8", errors="replace") as fh:
+                dated = [d for d in (day(l[:10]) for l in fh.read().splitlines()) if d]
+        except OSError:
+            return None
+        return (sum(d >= cutoff for d in dated), max(dated)) if dated else None
+
+    seen = {g: fires(r[3]) if r[3] else None for g, r in rows.items()}
+    late = [g for g in sorted(rows) if rows[g][2] < today]
+    quiet = [g for g in sorted(rows) if seen[g] is not None and seen[g][0] == 0]
+    print(f"guard-registry: report {today}, fire window {days} days")
+    print(f"guard-registry: {len(late)} of {len(rows)} guards past review-by")
+    for g in late:
+        n = "unknown" if seen[g] is None else f"{seen[g][0]} in {days}d"
+        print(f"  {g}  owner={rows[g][0]}  review-by={rows[g][2]}  fires={n}  why={rows[g][1]}")
+    print(f"guard-registry: {len(quiet)} guards with a fire log fired 0 times in the last {days} days")
+    for g in quiet:
+        print(f"  {g}  owner={rows[g][0]}  log={rows[g][3]}  newest={seen[g][1]}")
+    print(f"guard-registry: fires unknown for {sum(v is None for v in seen.values())} of {len(rows)} guards (no fire log registered, or the log is missing or holds no dated line)")
+    print("  owner: confirm each listed guard (bump review-by) or retire it; this report never deletes or edits a row")
+PY
+}
+
 [ "$#" -gt 0 ] || { usage; exit 2; }
 subcmd="$1"; shift
 case "$subcmd" in
@@ -1754,6 +1881,7 @@ case "$subcmd" in
   rules) cmd_rules "$@" ;;
   tests-wired) cmd_tests_wired "$@" ;;
   rails) cmd_rails "$@" ;;
+  guard-registry) cmd_guard_registry "$@" ;;
   -h|--help) usage; exit 0 ;;
   *) printf 'ci-gates: unknown subcommand: %s\n' "$subcmd" >&2; usage; exit 2 ;;
 esac
diff --git a/scripts/ci-tests.d/guard-registry.sh b/scripts/ci-tests.d/guard-registry.sh
new file mode 100644
index 000000000..774271690
--- /dev/null
+++ b/scripts/ci-tests.d/guard-registry.sh
@@ -0,0 +1,2 @@
+# Regression test for the guard-registry gate (#1592). Offline; its last block also runs the gate on the real registry.
+bash scripts/test-guard-registry.sh
diff --git a/scripts/ci-tests.d/privacy-guard.sh b/scripts/ci-tests.d/privacy-guard.sh
new file mode 100644
index 000000000..b264b8d11
--- /dev/null
+++ b/scripts/ci-tests.d/privacy-guard.sh
@@ -0,0 +1,2 @@
+# Registers scripts/test_privacy_guard.py with CI (see the "Per-PR tests" step in ci.yml).
+python3 scripts/test_privacy_guard.py
diff --git a/scripts/ci-tests.d/review-checks-new-rows.sh b/scripts/ci-tests.d/review-checks-new-rows.sh
new file mode 100644
index 000000000..6b40db2cd
--- /dev/null
+++ b/scripts/ci-tests.d/review-checks-new-rows.sh
@@ -0,0 +1,2 @@
+# Registers scripts/test-review-checks-new-rows.sh with CI (see the "Per-PR tests" step in ci.yml).
+bash scripts/test-review-checks-new-rows.sh
diff --git a/scripts/guard-registry.tsv b/scripts/guard-registry.tsv
new file mode 100644
index 000000000..1fe09e193
--- /dev/null
+++ b/scripts/guard-registry.tsv
@@ -0,0 +1,51 @@
+# scripts/guard-registry.tsv: one row for every hook a shipped template runs or install.sh writes, and every `scripts/ci-gates.sh` gate (#1592). A script no template wires (a CI-only gate script, a hand-installed hook) has no row; `ci-gates.sh rails` covers its `# rail:` header.
+# `ci-gates.sh guard-registry --registry scripts/guard-registry.tsv .` fails on a guard with no row, a row with an empty owner, reason or date,
+# and a row for a guard that no longer exists: add the row when you add the guard, delete it when you remove the guard.
+# FORMAT: `<id><TAB><owner role><TAB><reason><TAB><review-by YYYY-MM-DD>[<TAB><fire log>]`. Blank lines and lines starting with '#' are ignored.
+#   id: `hook:<skill>/<script>` (a script a shipped templates/*.settings.json runs), `hook:.githooks/<name>` (a git hook install.sh writes) or `gate:<name>` (a ci-gates.sh subcommand).
+#   owner role: a lowercase slug naming a skill or role, never a person. reason: one clause on what the guard stops. review-by: the day the owner next confirms it still earns its friction.
+#   fire log: optional path (`~` and $VARs expanded) of a log holding one `YYYY-MM-DD ...` line per fire; without one, or when the log is missing, emptied or holds no dated line, the report says "unknown", never "zero fires". The reply_cap row names the default location only: REPLY_CAP_LOG or XDG_CACHE_HOME moves the real log, and the report then reads the wrong file.
+# `ci-gates.sh guard-registry --report [--days N] --registry scripts/guard-registry.tsv .` lists the rows past review-by and the logged guards with no fire in N days (default 30).
+# It is read-only: it never edits or deletes a row. To confirm a guard, bump its review-by; to retire one, remove the guard and its row together.
+# The `hook:<skill>/<script>` rows repeat the owner, reason and review date of the script's own `# rail:` header (scripts/test-guard-registry.sh keeps the two equal).
+hook:.githooks/pre-push	deep-code-review	rerun the fast lint and unit tier before every push (opt in with core.hooksPath)	2027-01-30
+hook:agentic-delivery/bypass_guard.py	agentic-delivery	deny a git hook bypass: fix the failing hook instead	2027-01-30
+hook:agentic-delivery/ceo_altitude_guard.py	agentic-delivery	keep the main session delegating instead of hand-editing source	2027-01-30
+hook:agentic-delivery/comms_guard.py	agentic-delivery	warn when a PR or tracker write misses its artifact template	2027-01-30
+hook:agentic-delivery/context_nudge.py	agentic-delivery	nudge a handoff at a huge context since long sessions re-read it every turn	2027-01-30
+hook:agentic-delivery/decision_gate.py	agentic-delivery	ask the owner only after a recorded evil-twin and council pass	2027-01-30
+hook:agentic-delivery/destructive_guard.py	agentic-delivery	deny destructive host commands before they run (best effort; the OS sandbox is the boundary)	2027-01-30
+hook:agentic-delivery/finding_guard.py	agentic-delivery	deny gh issue create when the same finding is already filed	2027-01-30
+hook:agentic-delivery/flow_alarm.py	agentic-delivery	stop starting PRs while ready ones wait unmerged; alarm on a stalled flow	2027-01-30
+hook:agentic-delivery/freeze_hook.py	agentic-delivery	deny git push and gh pr merge while a freeze is on	2027-01-30
+hook:agentic-delivery/handback_cap.py	agentic-delivery	cap a subagent handback and audit each lane's prose	2027-01-30
+hook:agentic-delivery/handoff_inject.py	agentic-delivery	re-inject a short handoff after a compact so the plan survives	2027-01-30
+hook:agentic-delivery/heavy_gate.py	agentic-delivery	defer a heavy local command while the machine is busy	2027-01-30
+hook:agentic-delivery/landing_watchdog.py	agentic-delivery	flag a merge pipeline that landed nothing while green PRs wait	2027-01-30
+hook:agentic-delivery/lane_cap.py	agentic-delivery	tell a lane to checkpoint near its tool-call cap	2027-01-30
+hook:agentic-delivery/lane_resume_nudge.py	agentic-delivery	advise resuming an earlier same-domain lane over a costly new one	2027-01-30
+hook:agentic-delivery/outcome_claim_guard.py	agentic-delivery	no fixed/faster/done claim on a delivery outcome without a measurement	2027-01-30
+hook:agentic-delivery/perun_auto_update.py	agentic-delivery	keep an installed Perun current with no manual step	2027-01-30
+hook:agentic-delivery/pipe_mask_guard.py	agentic-delivery	flag a gate or push piped to tail/head/grep that masks its exit status	2027-01-30
+hook:agentic-delivery/privacy_guard.py	agentic-delivery	deny a GitHub write whose title or body matches the repo banlist except into a sibling repo of the origin owner and deny a write into Perun that names the session repository	2027-01-30
+hook:agentic-delivery/repeat_poll_guard.py	agentic-delivery	nudge when the same command runs more than 3 times in a session	2027-01-30
+hook:agentic-delivery/reply_cap.py	agentic-delivery	owner rule: chat replies max 3 lines and 500 chars	2027-01-30	~/.cache/perun/reply-cap.log
+hook:agentic-delivery/session_brief.py	agentic-delivery	surface at most 3 lines of fleet hygiene at session start	2027-01-30
+hook:agentic-delivery/stall_guard.py	agentic-delivery	nudge when an autonomous turn ends stopped or waiting with work still open	2027-01-30
+hook:agentic-delivery/subagent_brief_lint.py	agentic-delivery	stop a subagent brief that names a tool the lane does not have	2027-01-30
+hook:agentic-delivery/subagent_start_inject.py	agentic-delivery	inject the house standing defaults into every new subagent	2027-01-30
+hook:agentic-delivery/terse_reply_check.py	agentic-delivery	opt-in reply budget stated up front (never forces a rewrite)	2027-01-30
+gate:privacy	deep-code-review	no banned name, identifier or secret pattern in a file the repo ships	2027-01-30
+gate:routing	deep-code-review	every references file is routed from its SKILL.md and no SKILL.md outgrows the byte cap	2027-01-30
+gate:version	deep-code-review	VERSION is exact core semver and the first changelog heading announces it	2027-01-30
+gate:install	deep-code-review	the real installer lands each mode and the vendored docs are real, not placeholders	2027-01-30
+gate:enumeration	deep-code-review	every shipped skill appears in all five hand-maintained lists	2027-01-30
+gate:size	deep-code-review	every shipped SKILL.md and reference stays within its frozen byte budget	2027-01-30
+gate:size-ratchet	deep-code-review	a size budget rises only with a size-budget-raise marker	2027-01-30
+gate:fragments	deep-code-review	a changelog fragment carries the exact size-budget-raise marker and no release heading	2027-01-30
+gate:binaries	deep-code-review	no tracked image, media, archive or build-output file	2027-01-30
+gate:mustload	deep-code-review	the always-paid MUST-LOAD cost per archetype stays within its frozen ceiling	2027-01-30
+gate:rules	deep-code-review	a MUST, NEVER or ALWAYS rule names a mechanism or says advisory, and the unenforced baseline only shrinks	2027-01-30
+gate:tests-wired	agentic-delivery	every test script is run by CI or listed with a reason	2027-01-30
+gate:rails	agentic-delivery	every guard and hook script carries its owner, reason and review date in its header	2027-01-30
+gate:guard-registry	agentic-delivery	every installed hook and every gate has one row with an owner role, a reason and a review-by date	2027-01-30
diff --git a/scripts/perun_doctor.py b/scripts/perun_doctor.py
index b017a4cfb..30b26fce4 100644
--- a/scripts/perun_doctor.py
+++ b/scripts/perun_doctor.py
@@ -20,7 +20,7 @@
 SRC = Path(__file__).resolve().parent.parent
 SKIP = {".git", "node_modules", ".venv", "__pycache__", "worktrees", "skill-backups"}
 SKILL_HOSTS = (".claude", ".cursor", ".agents", ".codex", ".gemini", ".opencode", ".github", ".windsurf", ".hermes", ".kiro", ".cline", ".roo", ".factory", ".qwen", ".grok")  # every root install.sh can write
-HOOK_SCRIPTS = ("pipe_mask_guard.py", "bypass_guard.py", "destructive_guard.py", "subagent_start_inject.py", "handback_cap.py", "context_nudge.py", "lane_resume_nudge.py", "ceo_altitude_guard.py", "comms_guard.py", "outcome_claim_guard.py", "landing_watchdog.py", "stall_guard.py", "reply_cap.py", "decision_gate.py", "repeat_poll_guard.py", "subagent_brief_lint.py", "finding_guard.py", "flow_alarm.py", "freeze_hook.py")  # operating-layer template
+HOOK_SCRIPTS = ("pipe_mask_guard.py", "bypass_guard.py", "destructive_guard.py", "subagent_start_inject.py", "handback_cap.py", "context_nudge.py", "lane_resume_nudge.py", "ceo_altitude_guard.py", "comms_guard.py", "outcome_claim_guard.py", "landing_watchdog.py", "stall_guard.py", "reply_cap.py", "decision_gate.py", "repeat_poll_guard.py", "subagent_brief_lint.py", "finding_guard.py", "flow_alarm.py", "freeze_hook.py", "privacy_guard.py")  # operating-layer template
 
 
 def sha(p):
diff --git a/scripts/size-budgets.tsv b/scripts/size-budgets.tsv
index a76af5280..a212557ab 100644
--- a/scripts/size-budgets.tsv
+++ b/scripts/size-budgets.tsv
@@ -139,7 +139,7 @@
 .claude/skills/deep-code-review/references/language-stack-redflags.md	10082
 .claude/skills/deep-code-review/references/machine-report.md	13064
 .claude/skills/deep-code-review/references/merge-operations.md	79430
-.claude/skills/deep-code-review/references/method-situational.md	44396
+.claude/skills/deep-code-review/references/method-situational.md	44702
 .claude/skills/deep-code-review/references/method.md	29936
 .claude/skills/deep-code-review/references/method-diff.md	7872
 .claude/skills/deep-code-review/references/method-lenses.md	7743
@@ -208,9 +208,9 @@ README.md	16118
 .claude/skills/product-discovery/references/full-map.md	12384
 .claude/skills/growth-analytics/references/full-map.md	10661
 .claude/skills/positioning/references/full-map.md	9520
-.claude/skills/INDEX.md	16547
+.claude/skills/INDEX.md	16565
 .claude/skills/agentic-delivery/INDEX.md	4672
-.claude/skills/agentic-delivery/INDEX-scripts.md	17490
+.claude/skills/agentic-delivery/INDEX-scripts.md	17631
 .claude/skills/deep-code-review/INDEX.md	20553
 .claude/skills/deep-code-review/INDEX-scripts.md	6642
 .claude/skills/agentic-delivery/references/pipeline-optimizer.md	19857
diff --git a/scripts/test-guard-registry.sh b/scripts/test-guard-registry.sh
new file mode 100644
index 000000000..81035414f
--- /dev/null
+++ b/scripts/test-guard-registry.sh
@@ -0,0 +1,239 @@
+#!/usr/bin/env bash
+# Tests for `ci-gates.sh guard-registry` (#1592): every hook Perun installs and every ci-gates.sh gate has one row (owner role, reason,
+# review-by) in one TSV. A guard with no row, an empty reason, a bad date, a person as owner, a duplicate row, or a row for a guard that
+# is gone each fail the gate; `--report` is read-only and lists rows past review-by plus logged guards with no fire in N days ("unknown"
+# where there is no log). Hermetic: each case builds a throwaway fixture root under $TMPDIR (no repo state, no network); the last block
+# reads the real tree. Prints PASS/FAIL per case and a final "Tests: P/N"; exits non-zero on any failure. Run against a ci-gates.sh
+# without the subcommand (GATE=<old copy>), every case that drives the gate fails (exit 2, no such subcommand); only the two
+# real-tree file checks (header parity, reply_cap log path) do not depend on it.
+set -uo pipefail
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+WORK="$(mktemp -d "${TMPDIR:-/tmp}/dcr-test-guardreg.XXXXXX")" || exit 1
+trap 'rm -rf "$WORK"' EXIT
+GATE="${GATE:-$ROOT/scripts/ci-gates.sh}"
+pass=0 total=0
+ok() { total=$((total + 1)); if [ "$1" -eq 0 ]; then pass=$((pass + 1)); echo "PASS  $2"; else echo "FAIL  $2"; fi; }
+
+FUTURE="2999-12-31"  # a review date no clock reaches, so the gate cases never rot
+PAST="2000-01-01"
+TODAY="$(date +%F)"
+TEN_DAYS_AGO="$(python3 -c 'import datetime as d; print(d.date.today() - d.timedelta(days=10))')"
+YESTERDAY="$(python3 -c 'import datetime as d; print(d.date.today() - d.timedelta(days=1))')"
+
+# base: one row per guard of the fixture root below (a wired hook, a git hook, two gates)
+base() {
+  printf '%s\t%s\t%s\t%s\n' \
+    hook:demo/wired.py demo 'block a thing' "$FUTURE" \
+    hook:.githooks/pre-push demo 'rerun the tests' "$FUTURE" \
+    gate:alpha demo 'first gate' "$FUTURE" \
+    gate:beta-two demo 'second gate' "$FUTURE"
+}
+# mk <case>: a fixture root with a hook a template wires (wired.py; ghost.py is named but absent), a script no template wires (helper.py), a
+# dispatcher with two gates, an install.sh that writes one git hook and one non-hook file, and a registry holding the 4 base rows
+mk() {
+  R="$WORK/$1"; S="$R/.claude/skills/demo"; REG="$R/reg.tsv"; mkdir -p "$S/scripts" "$S/templates" "$R/scripts"
+  : >"$S/scripts/wired.py"; : >"$S/scripts/helper.py"
+  # shellcheck disable=SC2016  # file literals: $CLAUDE_PROJECT_DIR, ${GATES_SRC} and "$@" must reach the fixtures unexpanded
+  {
+    printf '%s\n' '{"hooks":{"Stop":[{"hooks":[{"type":"command","command":"python3 \"$CLAUDE_PROJECT_DIR/.claude/skills/demo/scripts/wired.py\""},{"type":"command","command":"python3 ghost.py"}]}]}}' >"$S/templates/demo.settings.json"
+    printf '%s\n' 'cmd_alpha() { :; }' 'cmd_beta_two() { :; }' 'case "$subcmd" in' '  alpha) cmd_alpha "$@" ;;' '  beta-two) cmd_beta_two "$@" ;;' '  -h|--help) usage; exit 0 ;;' '  *) usage; exit 2 ;;' 'esac' >"$R/scripts/ci-gates.sh"
+    printf '%s\n' '  write_gate_file "${GATES_SRC}/pre-push-verify.sh" "${TARGET_DIR}/.githooks/pre-push" 1' '  write_gate_file "${GATES_SRC}/dcr-gates.sh" "${TARGET_DIR}/scripts/dcr-gates.sh" 1' >"$R/install.sh"
+  }
+  { printf '# header\n\n'; base; } >"$REG"
+}
+drop() { grep -vF -- "$1"$'\t' "$REG" >"$REG.n"; mv "$REG.n" "$REG"; }  # <id>: remove that guard's row
+setrow() { drop "$1"; local IFS=$'\t'; printf '%s\n' "$*" >>"$REG"; }   # <id> <field>...: replace the row, one tab between fields
+run() { out="$(bash "$GATE" guard-registry --registry "$REG" "$@" "$R" 2>&1)"; rc=$?; }  # [option...]: the gate on the current fixture
+passes() { [ "$rc" -eq 0 ] && grep -qF -- "$1" <<<"$out"; ok $? "$2"; }   # <expected output substring> <label>
+fails() { [ "$rc" -eq 1 ] && grep -qF -- "$1" <<<"$out"; ok $? "$2"; }    # exit 1 (not 2 = no such subcommand) and the output says why
+has() { grep -qF -- "$1" <<<"$out"; }
+
+mk clean; run
+passes "guard-registry: ok (2 hooks, 2 gates)" "a registry with one row per hook and gate passes; a script no template wires, a template name that resolves to no script, and a non-hook install.sh file are not guards"
+mk 'br[a]cket*'; run
+passes "guard-registry: ok (2 hooks, 2 gates)" "a root with glob characters in its path works"
+mk relroot; out="$(cd "$R" && bash "$GATE" guard-registry --registry reg.tsv . 2>&1)"; rc=$?
+passes "guard-registry: ok (2 hooks, 2 gates)" "a relative root (.) works"
+
+# --- coverage: a guard with no row -------------------------------------------------------------------------------------------
+mk nohook; drop hook:demo/wired.py; run
+fails "hook:demo/wired.py is a guard with no row" "a hook script a template wires, with no row, fails and is named"
+mk nogate; drop gate:beta-two; run
+fails "gate:beta-two is a guard with no row" "a gate subcommand with no row fails and is named"
+mk nogit; drop hook:.githooks/pre-push; run
+fails "hook:.githooks/pre-push is a guard with no row" "a git hook install.sh writes, with no row, fails and is named"
+mk newgit
+# shellcheck disable=SC2016  # install.sh fixture text keeps ${GATES_SRC} unexpanded
+printf '%s\n' '  write_gate_file "${GATES_SRC}/x.sh" "${TARGET_DIR}/.githooks/pre-commit" 1' >>"$R/install.sh"; run
+fails "hook:.githooks/pre-commit is a guard with no row" "a second git hook install.sh writes needs its own row"
+mk second; : >"$S/scripts/wired2.py"; printf '%s\n' '{"hooks":{"PreToolUse":[{"hooks":[{"type":"command","command":"python3 ~/.claude/perun-rules/wired2.py"}]}]}}' >"$S/templates/two.settings.json"; run
+fails "hook:demo/wired2.py is a guard with no row" "a hook a second template wires by bare home path is found and needs a row"
+mk odd
+# shellcheck disable=SC2016  # fixture dispatcher text keeps $x and "$@" unexpanded
+printf '%s\n' 'cmd_gamma() { :; }' 'case "$x" in gamma) cmd_gamma "$@";; esac' >>"$R/scripts/ci-gates.sh"; run
+fails "a cmd_ function has no dispatcher line like" "a gate function dispatched in another shape is refused, so it cannot skip its row"
+mk empty; : >"$REG"; run
+fails "hook:demo/wired.py is a guard with no row" "an empty registry fails (every guard is missing)"
+mk blankhelp; setrow hook:demo/helper.py demo 'not wired' "$FUTURE"; run
+fails "hook:demo/helper.py: row names no guard that ships" "a row for a script no template wires is a stale row"
+
+# --- stale and duplicate rows -------------------------------------------------------------------------------------------------
+mk stalegate; setrow gate:gone demo 'was removed' "$FUTURE"; run
+fails "gate:gone: row names no guard that ships (delete the row)" "a row for a gate that no longer exists fails"
+mk stalehook; setrow hook:demo/old.py demo 'was deleted' "$FUTURE"; run
+fails "hook:demo/old.py: row names no guard that ships (delete the row)" "a row for a hook script that no longer exists fails"
+mk dup; setrow gate:alpha demo 'first gate' "$FUTURE"; printf 'gate:alpha\tdemo\tagain\t%s\n' "$FUTURE" >>"$REG"; run
+fails "gate:alpha: duplicate row" "two rows for one guard fail"
+mk wide; setrow gate:alpha demo 'first gate' "$FUTURE" '/tmp/x.log' extra; run
+fails "gate:alpha: 6 columns" "a row with more than 5 columns fails"
+mk noid; printf '\tdemo\treason\t%s\n' "$FUTURE" >>"$REG"; run
+fails "row has no id" "a row with an empty id fails"
+
+# --- owner, reason, date ------------------------------------------------------------------------------------------------------
+mk noowner; setrow gate:alpha '' 'first gate' "$FUTURE"; run
+fails "gate:alpha: owner must be a lowercase role slug" "an empty owner fails"
+for o in 'Jane Smith' 'jane@example.com' '@jsmith' 'Jane' 'jane smith' 'role_x' '-lead' '9lead'; do
+  mk person; setrow gate:alpha "$o" 'first gate' "$FUTURE"; run
+  fails "gate:alpha: owner must be a lowercase role slug (a role, never a person), got '$o'" "owner '$o' (a person, not a role slug) fails"
+done
+mk role; setrow gate:alpha release-owner 'first gate' "$FUTURE"; run
+passes "guard-registry: ok" "a lowercase role slug with a hyphen passes"
+mk noreason; setrow gate:alpha demo '' "$FUTURE"; run
+fails "gate:alpha: reason must not be empty" "an empty reason fails"
+mk blankreason; setrow gate:alpha demo '   ' "$FUTURE"; run
+fails "gate:alpha: reason must not be empty" "a blank reason fails"
+mk short; drop gate:alpha; printf 'gate:alpha\tdemo\n' >>"$REG"; run
+fails "gate:alpha: reason must not be empty" "a row cut after the owner has no reason"
+fails "gate:alpha: review-by '' is not a real YYYY-MM-DD date" "a row cut after the owner has no review-by either"
+mk nodate; drop gate:alpha; printf 'gate:alpha\tdemo\tfirst gate\n' >>"$REG"; run
+fails "gate:alpha: review-by '' is not a real YYYY-MM-DD date" "a row with no review-by column fails"
+for d in 2027-13-01 2027-02-30 2027-02-29 2027-00-10 2027-01-00 0000-01-01 27-1-1 2027-1-30 soon 2027-01-30T00:00 20270130 ""; do
+  mk bad-date; setrow gate:alpha demo 'first gate' "$d"; run
+  fails "review-by '$d' is not a real YYYY-MM-DD date" "review-by ${d:-<empty>} fails as a bad date"
+done
+# Arabic-Indic digits (UTF-8 bytes, so this file stays ASCII) are not digits here: a gate that used \d would accept them
+mk arabic-date; setrow gate:alpha demo 'first gate' "$(printf '\331\242\331\240\331\242\331\247-\331\240\331\241-\331\243\331\240')"; run
+fails "is not a real YYYY-MM-DD date" "a review-by written in Arabic-Indic digits fails (only 0-9 count)"
+mk leap; setrow gate:alpha demo 'first gate' 2028-02-29; run
+passes "guard-registry: ok" "a real leap day passes"
+mk allbad; setrow gate:alpha '' '' soon; run
+{ [ "$rc" -eq 1 ] && has "owner must be" && has "reason must not be empty" && has "is not a real YYYY-MM-DD date"; }; ok $? "one row with three faults reports all three"
+mk past; setrow gate:alpha demo 'first gate' "$PAST"; run
+{ [ "$rc" -eq 0 ] && has "guard-registry: ok (2 hooks, 2 gates)" && ! has "report"; }; ok $? "a past review-by does not fail the plain gate (no time bomb) and prints no report"
+mk comments; { printf '  # indented comment\n\n\n'; cat "$REG"; printf '# trailing\n'; } >"$REG.n"; mv "$REG.n" "$REG"; run
+passes "guard-registry: ok (2 hooks, 2 gates)" "comments (also indented) and blank lines are ignored"
+
+# --- fail closed and arguments -----------------------------------------------------------------------------------------------
+mk noreg; rm "$REG"; run
+fails "registry not found" "a missing registry fails closed"
+mk noskills; rm -r "$R/.claude"; run
+fails ".claude/skills not found (fail closed)" "a root without .claude/skills fails closed"
+mk nogates; rm "$R/scripts/ci-gates.sh"; run
+fails "scripts/ci-gates.sh not found (fail closed)" "a root without scripts/ci-gates.sh fails closed"
+mk noinstall; rm "$R/install.sh"; run
+fails "install.sh not found (fail closed)" "a root without install.sh fails closed"
+mk noguards; rm -r "$S/scripts" "$S/templates"; mkdir "$S/scripts"; : >"$R/install.sh"; : >"$REG"
+# shellcheck disable=SC2016  # fixture dispatcher text keeps $x unexpanded
+printf 'case "$x" in\nesac\n' >"$R/scripts/ci-gates.sh"; run
+fails "no hook or gate found (fail closed)" "a root that ships no guard at all fails closed instead of passing on an empty set"
+out="$(bash "$GATE" guard-registry "$WORK/clean" 2>&1)"; rc=$?
+fails "--registry <file> and <root> are required" "no registry fails"
+mk noroot; out="$(bash "$GATE" guard-registry --registry "$REG" 2>&1)"; rc=$?
+fails "--registry <file> and <root> are required" "no root fails"
+mk opt; run --bogus
+fails "unknown option: --bogus" "an unknown option fails"
+mk extra; run "$R"
+fails "unexpected extra argument" "a second root fails"
+out="$(bash "$GATE" guard-registry --registry 2>&1)"; rc=$?
+fails "--registry needs a value" "--registry with no value fails"
+mk dayval; out="$(bash "$GATE" guard-registry --report --days 2>&1)"; rc=$?
+fails "--days needs a value" "--days with no value fails"
+for d in 0 abc -3 100000 1.5 ""; do
+  mk bad-days; run --report --days "$d"
+  fails "--days wants a whole number from 1 to 99999, got: $d" "--days ${d:-<empty>} fails"
+done
+out="$(bash "$GATE" --help 2>&1)"; rc=$?
+{ [ "$rc" -eq 0 ] && has "guard-registry --registry <file> [--report [--days N]] <root>"; }; ok $? "--help lists the subcommand"
+
+# --- --report: read-only owner view --------------------------------------------------------------------------------------------
+mk rep-none; run --report
+{ [ "$rc" -eq 0 ] && has "guard-registry: report $TODAY, fire window 30 days" && has "0 of 4 guards past review-by" \
+  && has "0 guards with a fire log fired 0 times in the last 30 days" && has "fires unknown for 4 of 4 guards"; }
+ok $? "--report on current rows with no fire log lists nothing, says fires are unknown for every guard, and exits 0"
+{ [ "$rc" -eq 0 ] && has "this report never deletes or edits a row"; }; ok $? "--report tells the owner to confirm or retire and edits nothing"
+mk rep-gate-first; setrow gate:alpha demo 'first gate' soon; run --report
+{ [ "$rc" -eq 1 ] && has "FAIL gate:alpha: review-by 'soon'" && ! has "guard-registry: ok" && ! has "report $TODAY" && ! has Traceback; }; ok $? "--report on a malformed registry fails with the gate's message and prints no report"
+mk rep-past; setrow gate:alpha demo 'first gate' "$PAST"; run --report
+{ [ "$rc" -eq 0 ] && has "1 of 4 guards past review-by" && has "gate:alpha  owner=demo  review-by=$PAST  fires=unknown  why=first gate" && ! has "gate:beta-two  owner"; }
+ok $? "--report lists only the row past review-by, with owner, date, fire status and reason, and exits 0"
+mk rep-days; run --report --days 7
+has "fire window 7 days"; ok $? "--days sets the fire window"
+mk rep-today; setrow gate:alpha demo 'first gate' "$TODAY"; run --report
+{ [ "$rc" -eq 0 ] && has "0 of 4 guards past review-by"; }; ok $? "a review-by of today is not yet past"
+mk rep-yest; setrow gate:alpha demo 'first gate' "$YESTERDAY"; run --report
+{ [ "$rc" -eq 0 ] && has "1 of 4 guards past review-by"; }; ok $? "a review-by of yesterday is past"
+
+LOG="$WORK/fire.log"
+mk rep-old; printf '%s lines=6 chars=700\n%s lines=4 chars=600\n' "$PAST" "2001-02-03" >"$LOG"; setrow gate:alpha demo 'first gate' "$FUTURE" "$LOG"; run --report
+{ [ "$rc" -eq 0 ] && has "1 guards with a fire log fired 0 times in the last 30 days" && has "gate:alpha  owner=demo  log=$LOG  newest=2001-02-03" \
+  && has "fires unknown for 3 of 4 guards"; }
+ok $? "a guard whose log holds only old dated lines is listed with zero fires and its newest date; the other three stay unknown"
+mk rep-new; printf '%s lines=6 chars=700\n' "$PAST" >"$LOG"; printf '%s lines=2 chars=800\n' "$TODAY" >>"$LOG"; setrow gate:alpha demo 'first gate' "$FUTURE" "$LOG"; run --report
+{ [ "$rc" -eq 0 ] && has "0 guards with a fire log fired 0 times" && ! has "gate:alpha  owner"; }; ok $? "a guard with a dated line inside the window is not listed"
+mk rep-past-fired; setrow gate:alpha demo 'first gate' "$PAST" "$LOG"; run --report
+{ [ "$rc" -eq 0 ] && has "gate:alpha  owner=demo  review-by=$PAST  fires=1 in 30d  why=first gate"; }; ok $? "a row past review-by shows how often its logged guard fired"
+mk rep-win; printf '%s lines=6 chars=700\n' "$TEN_DAYS_AGO" >"$LOG"; setrow gate:alpha demo 'first gate' "$FUTURE" "$LOG"; run --report --days 5
+{ [ "$rc" -eq 0 ] && has "gate:alpha  owner=demo  log=$LOG  newest=$TEN_DAYS_AGO"; }; ok $? "a fire 10 days old is zero fires in a 5-day window"
+run --report --days 30
+{ [ "$rc" -eq 0 ] && has "0 guards with a fire log fired 0 times"; }; ok $? "the same fire counts inside a 30-day window"
+run --report --days 10
+{ [ "$rc" -eq 0 ] && has "0 guards with a fire log fired 0 times"; }; ok $? "a fire dated exactly N days ago is inside the N-day window"
+run --report --days 9
+{ [ "$rc" -eq 0 ] && has "1 guards with a fire log fired 0 times"; }; ok $? "a fire dated N+1 days ago is outside the N-day window"
+mk rep-missing; setrow gate:alpha demo 'first gate' "$FUTURE" "$WORK/no-such.log"; run --report
+{ [ "$rc" -eq 0 ] && has "0 guards with a fire log fired 0 times" && has "fires unknown for 4 of 4 guards"; }; ok $? "a fire log that does not exist is unknown, never zero fires"
+mk rep-undated; printf '{"lane":1}\nnot a date\n' >"$LOG"; setrow gate:alpha demo 'first gate' "$FUTURE" "$LOG"; run --report
+{ [ "$rc" -eq 0 ] && has "0 guards with a fire log fired 0 times" && has "fires unknown for 4 of 4 guards"; }; ok $? "a log with no dated line (another format) is unknown, never zero fires"
+mk rep-badday; printf '2026-13-45 lines=1\n' >"$LOG"; setrow gate:alpha demo 'first gate' "$FUTURE" "$LOG"; run --report
+{ [ "$rc" -eq 0 ] && has "fires unknown for 4 of 4 guards"; }; ok $? "a line that starts like a date but is not a real day does not count as a fire"
+mk rep-emptylog; : >"$LOG"; setrow gate:alpha demo 'first gate' "$FUTURE" "$LOG"; run --report
+{ [ "$rc" -eq 0 ] && has "0 guards with a fire log fired 0 times" && has "fires unknown for 4 of 4 guards"; }; ok $? "an existing empty log (truncated or rotated) is unknown, never zero fires"
+mk rep-dir; setrow gate:alpha demo 'first gate' "$FUTURE" "$WORK"; run --report
+{ [ "$rc" -eq 0 ] && has "fires unknown for 4 of 4 guards"; }; ok $? "a fire log path that is a directory is unknown"
+mk rep-home; mkdir "$WORK/home"; printf '%s lines=1 chars=9\n' "$PAST" >"$WORK/home/fire.log"
+# shellcheck disable=SC2088  # the registry cell holds a literal ~ for the gate to expand
+setrow gate:alpha demo 'first gate' "$FUTURE" '~/fire.log'
+out="$(HOME="$WORK/home" bash "$GATE" guard-registry --report --registry "$REG" "$R" 2>&1)"; rc=$?
+{ [ "$rc" -eq 0 ] && has "gate:alpha  owner=demo  log=~/fire.log  newest=$PAST"; }; ok $? "~ in the fire log path expands to HOME"
+# shellcheck disable=SC2016  # the registry cell holds a literal $VAR for the gate to expand
+setrow gate:alpha demo 'first gate' "$FUTURE" '$GUARD_TEST_DIR/fire.log'
+out="$(GUARD_TEST_DIR="$WORK/home" bash "$GATE" guard-registry --report --registry "$REG" "$R" 2>&1)"; rc=$?
+{ [ "$rc" -eq 0 ] && has "gate:alpha  owner=demo  log=\$GUARD_TEST_DIR/fire.log  newest=$PAST"; }; ok $? "an environment variable in the fire log path expands"
+mk rep-ro; setrow gate:alpha demo 'first gate' "$PAST" "$LOG"; printf '%s lines=1 chars=9\n' "$PAST" >"$LOG"
+before="$(cksum "$REG" "$LOG" "$S/scripts/wired.py" "$R/install.sh" "$R/scripts/ci-gates.sh"; find "$R" "$LOG" -type f | LC_ALL=C sort)"
+run --report
+after="$(cksum "$REG" "$LOG" "$S/scripts/wired.py" "$R/install.sh" "$R/scripts/ci-gates.sh"; find "$R" "$LOG" -type f | LC_ALL=C sort)"
+{ [ "$rc" -eq 0 ] && has "past review-by" && [ "$before" = "$after" ]; }; ok $? "--report on a past-due, zero-fire guard changes and removes nothing (registry, log, scripts and the file list are byte-identical)"
+
+# --- the real tree --------------------------------------------------------------------------------------------------------------
+REAL="$ROOT/scripts/guard-registry.tsv"
+nh="$(grep -c '^hook:' "$REAL")"; ng="$(grep -c '^gate:' "$REAL")"
+out="$(bash "$GATE" guard-registry --registry "$REAL" "$ROOT" 2>&1)"; rc=$?
+passes "guard-registry: ok ($nh hooks, $ng gates)" "the real registry passes: one row per installed hook and per ci-gates.sh gate (counts match the rows)"
+out="$(bash "$GATE" guard-registry --report --registry "$REAL" "$ROOT" 2>&1)"; rc=$?
+{ [ "$rc" -eq 0 ] && has "guard-registry: report $TODAY"; }; ok $? "--report runs on the real tree"
+# the hook rows repeat the owner and review date of the script's own `# rail:` header (scripts/ci-gates.sh rails); a change in one place must be made in both
+drift=""
+while IFS=$'\t' read -r id owner why review _; do
+  case "$id" in hook:.githooks/*|'#'*|'') continue ;; hook:*) ;; *) continue ;; esac
+  rest="${id#hook:}"
+  head -n 10 "$ROOT/.claude/skills/${rest%%/*}/scripts/${rest#*/}" | grep -qxF "# rail: owner=$owner, why=$why, review=$review" || drift="$drift $id"
+done <"$REAL"
+[ -z "$drift" ]; ok $? "every hook row carries the same owner, reason and review date as its script's # rail: header (drift:${drift:- none})"
+# shellcheck disable=SC2088  # compares against the literal ~ the registry cell holds
+{ grep -qF "perun/reply-cap.log" "$ROOT/.claude/skills/agentic-delivery/scripts/reply_cap.py" \
+  && [ "$(grep -F 'hook:agentic-delivery/reply_cap.py' "$REAL" | cut -f5)" = "~/.cache/perun/reply-cap.log" ]; }
+ok $? "the reply_cap row's fire log is the path reply_cap.py writes"
+
+echo "Tests: $pass/$total"
+[ "$pass" -eq "$total" ]
diff --git a/scripts/test-review-checks-new-rows.sh b/scripts/test-review-checks-new-rows.sh
new file mode 100644
index 000000000..358c94af6
--- /dev/null
+++ b/scripts/test-review-checks-new-rows.sh
@@ -0,0 +1,63 @@
+#!/usr/bin/env bash
+# review_checks.sh marks each diff-mode row "new": true when its file+line is on a line BASE...HEAD adds, false for a pre-existing
+# line (also one shifted down, or in a renamed file) and for a file-level (line 0) row; --full and --history omit the key; no row is
+# dropped. A fake shellcheck on a hermetic PATH reports one row per FIXME line, so the same rows come out on any host. The repo
+# carries hostile git config (no rename detection, no prefixes, merged hunks, forced colour, an external diff, a textconv that drops
+# a line): the script must pin its own diff flags.
+# REVIEW_CHECKS overrides the script under test (to prove the cases fail on the old one).
+set -uo pipefail  # no -e: a failed jq must reach chk, which prints the FAIL line
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+RC="${REVIEW_CHECKS:-$ROOT/.claude/skills/deep-code-review/scripts/review_checks.sh}"
+T=$(mktemp -d "${TMPDIR:-/tmp}/dcr-test-newrows.XXXXXX"); trap 'rm -rf "$T"' EXIT
+pass=0 total=0
+chk() { total=$((total + 1)); if [ "$1" -eq 0 ]; then pass=$((pass + 1)); echo "PASS  $2"; else echo "FAIL  $2"; fi; }
+g() { git -c user.email=t@example.com -c user.name=t "$@"; }
+mkdir "$T/bin" "$T/sys" "$T/repo"
+for b in bash env git grep sed head tail cat rm mkdir mktemp dirname basename python3 perl timeout gtimeout jq true sort uniq paste tr cut wc awk date cp mv ls find touch tee readlink sleep; do
+  p=$(type -P "$b") && ln -s "$p" "$T/sys/$b"  # system binaries only: a scanner installed on the host cannot add rows
+done
+cat >"$T/bin/shellcheck" <<'STUB'
+#!/usr/bin/env bash
+f=${!#}
+grep -an FIXME "$f" | while IFS=: read -r n _; do echo "$f:$n:1: warning: fixme [SC9001]"; done
+if grep -aq ZERO "$f"; then echo "$f:0:1: warning: file level [SC9002]"; fi
+exit 0
+STUB
+chmod +x "$T/bin/shellcheck"
+cd "$T/repo" && g init -q -b main .
+git config diff.renames false; git config diff.noprefix true; git config diff.interHunkContext 8; git config color.ui always
+git config diff.external echo; git config diff.skip1.textconv 'sed 1d'; echo '*.sh diff=skip1' >.gitattributes
+printf 'echo one\necho FIXME old\necho three\necho four\n' >a.sh
+printf 'echo 1\necho FIXME renamed\necho 3\necho 4\necho 5\necho 6\n' >ren.sh
+printf 'echo FIXME pure\necho 2\n' >pure.sh
+g add -A; g commit -q -m base; g branch base
+g checkout -q -b feat
+printf 'echo one\necho FIXME added\necho FIXME old\necho three\necho FIXME added too\necho four\n' >a.sh  # two hunks with a pre-existing line between them
+g mv ren.sh moved.sh; printf 'echo FIXME new\n' >>moved.sh
+g mv pure.sh pure2.sh
+printf 'echo hi\necho FIXME ZERO\n' >fresh.sh
+printf 'echo FIXME\n' >"sp ace.sh"
+printf 'echo a\necho FIXME\0\n' >nul.sh  # a NUL byte makes git call the file binary unless diffed with -a
+g add -A; g commit -q -m feat
+run() { PATH="$T/bin:$T/sys" DCR_USER_BIN= bash "$RC" --base base "$@" 2>"$T/err" >"$T/out"; }
+row() { jq -e --arg f "$1" --argjson l "$2" --argjson n "$3" 'any(.[]; .tool == "shellcheck" and .file == $f and .line == $l and .new == $n)' "$T/out" >/dev/null; }
+run
+row a.sh 2 true; chk $? "edited file: the added line is new"
+row a.sh 3 false; chk $? "edited file: a pre-existing finding shifted down, between two hunks, is not new and its row is kept"
+row a.sh 5 true; chk $? "edited file: the second hunk's added line is new"
+row moved.sh 2 false; chk $? "renamed and edited file: a pre-existing line is not new"
+row moved.sh 7 true; chk $? "renamed and edited file: the added line is new"
+row pure2.sh 1 false; chk $? "pure rename: not new"
+row fresh.sh 2 true; chk $? "new file: its line is new"
+row fresh.sh 0 false; chk $? "file-level row (line 0) is false even in a new file"
+row "sp ace.sh" 1 true; chk $? "path with a space"
+row nul.sh 2 true; chk $? "text file with a NUL byte still has its added lines"
+jq -e 'length > 0 and all(.[]; .new | type == "boolean")' "$T/out" >/dev/null; chk $? "every row carries a boolean new"
+n=$(jq '[.[] | select(.new)] | length' "$T/out"); m=$(jq length "$T/out")
+grep -qxF "review_checks: $n of $m rows are on lines this diff adds" "$T/err"; chk $? "stderr: $n of $m rows are on lines this diff adds"
+for mode in --full --history; do
+  run "$mode"
+  jq -e 'length > 0 and all(.[]; has("new") | not)' "$T/out" >/dev/null; chk $? "$mode: rows have no new key"
+  ! grep -q 'rows are on lines this diff adds' "$T/err"; chk $? "$mode: no count line"
+done
+echo "Tests: $pass/$total"; [ "$pass" -eq "$total" ]
diff --git a/scripts/test_privacy_guard.py b/scripts/test_privacy_guard.py
new file mode 100644
index 000000000..e9fb1dc25
--- /dev/null
+++ b/scripts/test_privacy_guard.py
@@ -0,0 +1,437 @@
+#!/usr/bin/env python3
+"""Offline tests for agentic-delivery privacy_guard.py: a banlisted identifier in the title or body of a GitHub write is denied for
+every tool form comms_guard reads unless the write's explicit target is a sibling repository of the session origin's owner, a write
+into the Perun repository from another repository's session that names that repository is denied too, the reason carries line and pattern numbers but never the matched text or the name, and every failure to read allows.
+Fixtures are fictional (Acme Capital, nightjar-7, acme/acme-widgets) in throwaway git repos; no network, no real banlist."""
+import json
+import os
+import shutil
+import subprocess
+import sys
+import tempfile
+import unittest
+from unittest import mock
+
+ROOT = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+SK = os.path.join(ROOT, ".claude/skills/agentic-delivery")
+GUARD = os.path.join(SK, "scripts/privacy_guard.py")
+TEMPLATE = os.path.join(SK, "templates/operating-layer.settings.json")
+sys.path.insert(0, os.path.dirname(GUARD))
+import comms_guard as G  # noqa: E402
+import privacy_guard as P  # noqa: E402
+
+IDENT = "Acme Capital"  # banned by the local banlist: pattern 3
+CODE = "nightjar-7"  # banned by the committed banlist: pattern 1 (the leading spaces of its line are stripped)
+COMMITTED = "# fixture banlist\n# Globex Corp is a comment, never a pattern\n\n# --- Names ---\n  [Nn]ightjar-[0-9]\n(unclosed\n"  # 2 patterns, the 2nd an invalid ERE
+LOCAL = "Acme Capital\n"
+URL = "https://api.github.com/repos/o/r"
+
+
+def git(cwd, *args):
+    subprocess.run(["git", "-c", "user.name=Jane Smith", "-c", "user.email=jane@example.com", *args], cwd=cwd, check=True, capture_output=True)
+
+
+class Base(unittest.TestCase):
+    def setUp(self):
+        self.tmp = tempfile.mkdtemp(prefix="privacy-guard-")
+        self.addCleanup(shutil.rmtree, self.tmp, True)
+        self.repo = self.make("repo", COMMITTED, LOCAL)
+
+    def make(self, name, committed=None, local=None):
+        d = os.path.join(self.tmp, name)
+        os.makedirs(d)
+        git(d, "init", "-q")
+        for f, text in ((".banlist.txt", committed), (".banlist.local.txt", local)):
+            if text is not None:
+                with open(os.path.join(d, f), "w") as fh:
+                    fh.write(text)
+        return d
+
+    def write(self, name, text):
+        p = os.path.join(self.tmp, name)
+        with open(p, "w") as fh:
+            fh.write(text)
+        return p
+
+    def hook(self, cmd, cwd=None, env=None, tool="Bash", raw=None):
+        e = {k: v for k, v in os.environ.items() if k != "PERUN_PRIVACY_GUARD"}
+        e.update(env or {})
+        payload = raw if raw is not None else json.dumps({"tool_name": tool, "tool_input": {"command": cmd}, "cwd": cwd or self.repo})
+        p = subprocess.run([sys.executable, GUARD], input=payload, capture_output=True, text=True, env=e)
+        return p.returncode, p.stdout, p.stderr
+
+    def denied(self, cmd, **kw):
+        rc, out, err = self.hook(cmd, **kw)
+        self.assertEqual((rc, out), (2, ""), cmd)
+        self.assertNotIn(IDENT, out + err, "the reason must never echo the matched text")
+        self.assertNotIn(CODE, out + err)
+        return err
+
+    def allowed(self, cmd, **kw):
+        self.assertEqual(self.hook(cmd, **kw), (0, "", ""), cmd)
+
+
+class Deny(Base):
+    def test_every_write_form_is_denied_without_echoing_the_text(self):
+        body = self.write("body.md", f"intro\n{IDENT}\n")
+        data = self.write("data.json", json.dumps({"title": "t", "body": f"see {IDENT}"}))
+        forms = [
+            f"gh pr create --title t --body 'Moves {IDENT} to the new queue'",
+            f"gh pr edit 4 -b 'note: {IDENT}'",
+            f"gh issue create --title t --body \"$(cat <<'EOF'\nline one\nline two {IDENT}\nEOF\n)\"",
+            f"gh issue comment 3 --body-file {body}",
+            f"gh pr comment 5 -F - <<'EOF'\n{IDENT}\nEOF",
+            f"gh release create v1 --notes 'for {IDENT}'",
+            f"cd {self.repo} && git push && gh pr create --title t --body '{IDENT}'",
+            f"gh api repos/o/r/issues -f body='{IDENT}'",
+            f"gh api repos/o/r/pulls -F body=@{body}",
+            f"gh api repos/o/r/issues --input {data}",
+            f"curl -X POST {URL}/issues/7/comments -d '{{\"body\":\"{IDENT}\"}}'",
+            f"curl -X PATCH {URL}/pulls/9 --data-binary @{data}",
+        ]
+        for cmd in forms:
+            self.assertIn("body line", self.denied(cmd), cmd)
+
+    def test_every_title_form_is_denied(self):
+        forms = [
+            f"gh pr create --title '{IDENT} rollout' --body ok",
+            f"gh issue create -t \"{IDENT}\" -b ok",
+            f"gh release create v1 --title '{IDENT}' --notes ok",
+            f"gh pr edit 2 --title=\"{IDENT}x\"",
+            f"gh api repos/o/r/issues -f title='{IDENT}' -f body=ok",
+            f"curl -X POST {URL}/pulls -d '{{\"title\":\"{IDENT}\",\"body\":\"ok\"}}'",
+        ]
+        for cmd in forms:
+            err = self.denied(cmd)
+            self.assertIn("title (pattern 3)", err, cmd)
+            self.assertNotIn("body line", err, cmd)
+
+    def test_reason_gives_line_and_pattern_numbers_only(self):
+        err = self.denied(f"gh pr create --title t --body \"$(cat <<'EOF'\nfine\nstill fine\n{IDENT} and {CODE}\nEOF\n)\"")
+        # line 3 matches pattern 1 (committed) and pattern 3 (local); pattern 2 is an invalid ERE and is skipped, not renumbered
+        self.assertIn("body line 3 (pattern 1); body line 3 (pattern 3).", err)
+
+    def test_reason_names_five_hits_and_counts_the_rest(self):
+        lines = "\n".join(f"row {n} {IDENT}" for n in range(7))
+        err = self.denied(f"gh issue comment 1 --body '{lines}'")
+        self.assertEqual((err.count("(pattern 3)"), "; 2 more." in err), (5, True))
+
+    def test_matching_is_grep_ere_and_case_sensitive(self):
+        posix = self.make("posix", "[[:upper:]]{3}-[0-9]{4}\n")  # a POSIX class: Python's re would read it as a different set
+        self.assertEqual(self.hook("gh issue comment 1 -b 'see ABC-1234'", cwd=posix)[0], 2)
+        self.assertEqual(self.hook("gh issue comment 1 -b 'see abc-1234'", cwd=posix)[0], 0)
+
+    def test_linked_worktree_reads_the_main_checkouts_local_banlist(self):
+        git(self.repo, "add", ".banlist.txt")
+        git(self.repo, "commit", "-q", "-m", "init")
+        wt = os.path.join(self.tmp, "wt")
+        git(self.repo, "worktree", "add", "-q", wt, "-b", "lane")
+        self.assertFalse(os.path.exists(os.path.join(wt, ".banlist.local.txt")))  # gitignored files are not checked out
+        self.assertIn("pattern 3", self.denied(f"gh pr create --title t --body '{IDENT}'", cwd=wt))
+        self.assertIn("pattern 1", self.denied(f"gh pr create --title t --body '{CODE}'", cwd=wt))
+
+
+class Allow(Base):
+    def test_clean_text_and_unrelated_commands(self):
+        for cmd in ("gh pr create --title t --body 'all good'", "gh issue comment 3 -b 'Globex Corp is only a comment in the banlist'",
+                    f"git commit -m '{IDENT}'", f"gh pr list --search '{IDENT}'", "gh pr view 5", "ls -la",
+                    f"echo {IDENT}", f"gh api repos/o/r/issues -f state=closed -f note='{IDENT}'"):
+            self.allowed(cmd)
+
+    def test_no_repo_no_banlist_or_a_banlist_with_no_patterns(self):
+        nogit = os.path.join(self.tmp, "nogit")
+        os.makedirs(nogit)
+        for cwd in (self.make("bare"), self.make("empty", "# only a comment\n   \n# --- Names ---\n"), nogit):
+            self.allowed(f"gh pr create --title '{IDENT}' --body '{IDENT}'", cwd=cwd)
+
+    def test_unreadable_body_allows_but_a_readable_title_is_still_checked(self):
+        self.allowed("gh pr create --title t --body-file /nonexistent/body.md")
+        self.allowed(f"curl -X POST {URL}/issues -d 'not json'")
+        self.assertIn("title (pattern 3)", self.denied(f"gh pr create --title '{IDENT}' --body-file /nonexistent/body.md"))
+
+    def test_opt_out_env(self):
+        for v in ("off", "0", "FALSE"):
+            self.allowed(f"gh pr create --title t --body '{IDENT}'", env={"PERUN_PRIVACY_GUARD": v})
+
+    def test_fail_open_on_bad_input_and_other_tools(self):
+        for raw in ("not json", "", "[]", json.dumps({"tool_name": "Bash", "tool_input": [1]}), json.dumps({"tool_name": "Bash", "tool_input": {"command": 7}})):
+            self.assertEqual(self.hook("", raw=raw), (0, "", ""), raw)
+        self.allowed(f"gh pr create --title t --body '{IDENT}'", tool="Edit")
+
+
+class RestField(unittest.TestCase):
+    def test_title_and_body_from_each_rest_form(self):
+        with tempfile.TemporaryDirectory(prefix="privacy-guard-rest-") as d:
+            for name, text in (("t.txt", "File title"), ("b.txt", "File body"), ("j.json", json.dumps({"title": "Json title", "body": "Json body"}))):
+                with open(os.path.join(d, name), "w") as fh:
+                    fh.write(text)
+            cases = [
+                ("gh api repos/o/r/issues -f title=Plain -f body=B", "title", "Plain"),
+                ("gh api repos/o/r/issues -f body=B -f 'title=Quoted title'", "title", "Quoted title"),
+                ("gh api repos/o/r/issues -F title=@t.txt", "title", "File title"),
+                ("gh api repos/o/r/issues --input j.json", "title", "Json title"),
+                ("curl -X POST u/repos/o/r/pulls -d @j.json", "body", "Json body"),
+                ("curl -X POST u/repos/o/r/pulls -d '{\"title\":\"Curl title\"}'", "title", "Curl title"),
+                ("gh api repos/o/r/issues -f body=B", "title", None),
+                ("gh api repos/o/r/issues -F body=@b.txt --jq .id", "body", "File body"),  # more arguments after the file
+                ("gh api repos/o/r/issues -F 'body=@b.txt' -f title=t", "body", "File body"),
+                ("gh api repos/o/r/issues -F body=@b.txt && echo done", "body", "File body"),
+            ]
+            for cmd, key, want in cases:
+                self.assertEqual(G._rest_field(cmd, d, key), want, cmd)
+
+
+class Extraction(Base):
+    def test_body_file_field_with_more_arguments_after_it(self):
+        body = self.write("body.md", f"intro\n{IDENT}\n")
+        for cmd in (f"gh api repos/o/r/issues/5/comments -F body=@{body} --jq .id", f"gh api repos/o/r/issues -F body=@{body} -f title=t",
+                    f"gh api repos/o/r/issues -F body=@{body} && echo done", f"gh api repos/o/r/issues -F 'body=@{body}' --jq .id",
+                    f"gh api repos/o/r/issues -F \"body=@{body}\" --jq .id", f"gh api repos/o/r/issues -f title=t -F body=@{body}"):
+            self.assertIn("body line 2 (pattern 3)", self.denied(cmd), cmd)
+
+    def test_a_flag_like_word_inside_a_quoted_value_or_a_heredoc_body_is_not_a_flag(self):
+        body = self.write("body.md", f"intro\n{IDENT}\n")
+        stray = "It's the \"foo\" thing, don't \"bar -t x"  # quotes that pair with nothing, and a flag-like word
+        for cmd, want in ((f"gh pr create --title \"Add -b flag\" --body \"{IDENT}\"", "body line 1 (pattern 3)"),
+                          (f"gh issue create --title \"Support -F option\" --body-file {body}", "body line 2 (pattern 3)"),
+                          (f"gh pr create --body \"run pytest -t smoke\" --title \"{IDENT}\"", "title (pattern 3)"),
+                          (f"gh pr create --body \"$(cat <<'EOF'\n{stray}\nEOF\n)\" --title \"{IDENT}\"", "title (pattern 3)")):
+            self.assertIn(want, self.denied(cmd), cmd)
+        self.allowed("gh pr create --title \"Add -b flag\" --body \"fine\"")
+
+    def test_every_write_in_a_command_is_read(self):
+        for cmd in (f"gh issue comment 1 -b ok && gh issue comment 2 -b '{IDENT}'", f"echo 'gh pr create later'; gh api repos/o/r/issues -f body='{IDENT}'"):
+            self.assertIn("body line 1 (pattern 3)", self.denied(cmd), cmd)
+        self.assertIn("body line 1 (pattern 1); body line 1 (pattern 3)", self.denied(f"gh issue comment 1 -b '{CODE}' && gh issue comment 2 -b '{IDENT}'"))
+        self.allowed("gh issue comment 1 -b ok && gh issue comment 2 -b fine")
+
+
+class SelfWritten(Base):
+    def test_a_body_file_the_command_writes_is_read_from_its_heredocs(self):
+        f = os.path.join(self.tmp, "new-body.md")  # absent on disk
+        for write in (f"cat > {f} <<'EOF'", f"cat >> {f} <<'EOF'", f"tee {f} <<'EOF'", f"tee -a '{f}' <<'EOF'"):
+            for send in (f"gh pr create --title t --body-file {f}", f"gh issue comment 1 --body \"$(cat {f})\"", f"gh api repos/o/r/issues -F body=@{f}"):
+                self.assertIn("body line 2 (pattern 3)", self.denied(f"{write}\nfine\n{IDENT}\nEOF\n{send}"), (write, send))
+        self.assertFalse(os.path.exists(f))
+
+    def test_a_stale_body_file_rewritten_in_the_same_command_is_not_scanned(self):
+        stale = self.write("stale.md", f"old draft {IDENT}\n")
+        self.denied(f"gh pr create --title t --body-file {stale}")  # control: with no rewrite, the old text on disk goes out
+        self.allowed(f"cat > {stale} <<'EOF'\nreworded\nEOF\ngh pr create --title t --body-file {stale}")
+        self.allowed(f"cat > {stale} <<'EOF'\nreworded\nEOF\ngh api repos/o/r/issues -F body=@{stale}")
+
+
+class OwnRepo(Base):
+    """A write into SELF_REPO from a session whose origin is another repository must not name that repository."""
+    TEXT = "Field report: acme-widgets crashed"
+
+    def session(self, name, url):
+        d = self.make(name)  # no banlist: the rule does not need one
+        if url:
+            git(d, "remote", "add", "origin", url)
+        return d
+
+    def test_denied_when_a_write_to_perun_names_the_session_repository(self):
+        s = self.session("https", "https://github.com/acme/acme-widgets.git")
+        t = self.TEXT
+        for cmd in (f"gh issue create -R protocol/perun --title t --body '{t}'", f"gh issue create --repo protocol/perun --title t --body '{t}'",
+                    f"gh issue create --repo=protocol/perun --title t --body '{t}'", f"gh issue create --title t --body '{t}' -R \"protocol/perun\"",
+                    f"gh api repos/protocol/perun/issues -f title=t -f body='{t}'", f"gh pr comment https://github.com/protocol/perun/pull/12 --body '{t}'",
+                    f"curl -X POST https://api.github.com/repos/protocol/perun/issues -d '{{\"title\":\"t\",\"body\":\"{t}\"}}'",
+                    "gh issue create -R PROTOCOL/Perun --title t --body 'ACME-WIDGETS again'"):
+            err = self.denied(cmd, cwd=s)
+            self.assertIn("this write to protocol/perun names the session's own repository", err, cmd)
+            self.assertIn("body line 1", err, cmd)
+            self.assertNotIn("acme", err.lower(), "the reason must not name the session repository")
+
+    def test_title_owner_slash_name_and_an_ssh_origin(self):
+        err = self.denied("gh issue create -R protocol/perun --title 'About acme/acme-widgets' --body ok", cwd=self.session("ssh", "git@github.com:acme/acme-widgets"))
+        self.assertIn("(name withheld): title.", err)
+        self.assertNotIn("acme", err.lower())
+
+    def test_allowed_elsewhere_or_with_no_other_repository_in_play(self):
+        s, t = self.session("https", "https://github.com/acme/acme-widgets.git"), self.TEXT
+        for cmd in (f"gh issue create -R other/repo --title t --body '{t}'", f"gh issue create --title t --body '{t}'",
+                    f"gh issue create -R protocol/perun-extras --title t --body '{t}'", "gh issue create -R protocol/perun --title t --body 'a plain report'"):
+            self.allowed(cmd, cwd=s)
+        for name, url, text in (("perun", "git@github.com:protocol/perun.git", "see protocol/perun"), ("perun2", "https://github.com/Protocol/Perun", "see protocol/perun"),
+                                ("none", None, t), ("bare", "somewhere", t)):  # the session is Perun itself, or has no usable origin
+            self.allowed(f"gh issue create -R protocol/perun --title t --body '{text}'", cwd=self.session(name, url))
+
+    def test_a_bare_name_counts_only_when_distinctive(self):
+        s = self.session("app", "https://github.com/acme/app.git")  # 3 plain characters: ordinary English
+        self.allowed("gh issue create -R protocol/perun --title t --body 'the app crashed'", cwd=s)
+        self.assertIn("body line 1", self.denied("gh issue create -R protocol/perun --title t --body 'see acme/app'", cwd=s))
+        for name, rc in (("widgets", 0), ("gadgetry", 2), ("my_pkg", 2)):  # 7 plain characters, 8, and an underscore
+            s = self.session(name, f"https://github.com/acme/{name}")
+            self.assertEqual(self.hook(f"gh issue create -R protocol/perun --title t --body 'the {name} crashed'", cwd=s)[0], rc, name)
+
+    def test_whole_word_and_case_insensitive(self):
+        s = self.session("dots", "https://github.com/acme/site.io")
+        for text, rc in (("see site.io", 2), ("see SITE.IO.", 2), ("mysite.io", 0), ("site.iox", 0), ("siteXio", 0)):
+            self.assertEqual(self.hook(f"gh issue create -R protocol/perun --title t --body '{text}'", cwd=s)[0], rc, text)
+
+    def test_banlist_and_own_repository_hits_are_both_reported(self):
+        git(self.repo, "remote", "add", "origin", "https://github.com/acme/acme-widgets.git")
+        err = self.denied(f"gh issue create -R protocol/perun --title t --body 'acme-widgets and {IDENT}'")
+        self.assertIn("matches the repo banlist (matched text withheld): body line 1 (pattern 3).", err)
+        self.assertIn("names the session's own repository (name withheld): body line 1.", err)
+        self.assertNotIn("acme", err.lower())
+
+    def test_a_failing_git_means_no_rule_not_an_error(self):
+        for exc in (OSError(), subprocess.TimeoutExpired("git", 5)):
+            with mock.patch.object(P.subprocess, "run", side_effect=exc):
+                self.assertEqual((P._git(self.repo, "status"), P._own_names(self.repo)), ("", None))
+
+
+class Scope(Base):
+    """The banlist scan is skipped only for a write whose explicit target is a sibling: another repository of the session origin's owner.
+    The session here is acme/acme-widgets; the banlist has no entry for any repository name."""
+
+    def setUp(self):
+        super().setUp()
+        git(self.repo, "remote", "add", "origin", "https://github.com/acme/acme-widgets.git")
+
+    def test_a_sibling_target_is_not_scanned(self):
+        t = f"'{IDENT} and {CODE}'"
+        for cmd in (f"gh pr create --repo acme/acme-gadgets --title t --body {t}", f"gh issue create -R acme/acme-gadgets --title t --body {t}",
+                    f"gh issue create --repo=acme/acme-gadgets --title t --body {t}", f"gh issue create -R \"acme/acme-gadgets\" --title t --body {t}",
+                    f"gh issue create -R github.com/ACME/Acme-Gadgets --title t --body {t}", f"gh issue create --title '{IDENT}' -R acme/acme-gadgets --body ok",
+                    f"gh issue comment https://github.com/acme/acme-gadgets/issues/5 --body {t}", f"gh api repos/acme/acme-gadgets/issues -f title=t -f body={t}",
+                    f"gh issue create --repo https://github.com/acme/acme-gadgets.git --title t --body {t}",
+                    f"curl -X POST 'https://api.github.com/repos/acme/acme-gadgets/issues' -d '{{\"title\":\"{IDENT}\"}}'"):
+            self.allowed(cmd)
+
+    def test_the_own_repository_perun_and_other_owners_are_scanned(self):
+        for cmd in (f"gh issue create --title t --body '{IDENT}'", f"gh issue create -R acme/acme-widgets --title t --body '{IDENT}'",
+                    f"gh issue create -R ACME/Acme-Widgets --title t --body '{IDENT}'", f"gh api repos/acme/acme-widgets/issues -f title=t -f body='{IDENT}'",
+                    f"gh issue create -R protocol/perun --title t --body '{IDENT}'", f"gh issue create -R other/acme-gadgets --title t --body '{IDENT}'",
+                    f"gh api repos/other/acme-gadgets/issues -f body='{IDENT}'", f"gh issue comment https://github.com/other/acme-gadgets/issues/5 --body '{IDENT}'",
+                    f"gh issue create -R acme/acme-gadgets -R protocol/perun --title t --body '{IDENT}'",  # a sibling and Perun
+                    f"gh issue create --repo https://github.com/acme/acme-widgets.git --title t --body '{IDENT}'",  # the clone URL of the session repository
+                    f"gh pr create --title t --body '{IDENT}' -r acme/reviewers"):  # -r names a reviewer, not a repository
+            self.assertIn("(pattern 3)", self.denied(cmd), cmd)
+
+    def test_the_origin_matches_in_any_case(self):
+        s = self.make("upper", COMMITTED, LOCAL)
+        git(s, "remote", "add", "origin", "https://github.com/ACME/Acme-Widgets.git")
+        self.allowed(f"gh issue create -R acme/acme-gadgets --title t --body '{IDENT}'", cwd=s)
+        self.assertIn("(pattern 3)", self.denied(f"gh issue create -R acme/acme-widgets --title t --body '{IDENT}'", cwd=s))
+
+    def test_perun_is_scanned_under_an_origin_in_its_own_org(self):
+        s = self.make("org", COMMITTED, LOCAL)
+        git(s, "remote", "add", "origin", "https://github.com/protocol/other-tool.git")
+        self.assertIn("(pattern 3)", self.denied(f"gh issue create -R protocol/perun --title t --body '{IDENT}'", cwd=s))
+        self.allowed(f"gh issue create -R protocol/another --title t --body '{IDENT}'", cwd=s)
+
+    def test_no_usable_origin_scans_everything(self):
+        for name, url in (("none", None), ("bare", "somewhere"), ("perun", "git@github.com:protocol/perun.git")):
+            s = self.make(name, COMMITTED, LOCAL)
+            if url:
+                git(s, "remote", "add", "origin", url)
+            self.assertIn("(pattern 3)", self.denied(f"gh issue create -R protocol/another --title t --body '{IDENT}'", cwd=s), name)
+
+    def test_text_that_only_names_a_sibling_sets_no_target(self):
+        s, sib = "https://github.com/acme/acme-gadgets/issues/3", "repos/acme/acme-gadgets/issues/3"
+        os.makedirs(os.path.join(self.tmp, "repos/acme/acme-gadgets"))
+        bodyfile = self.write("repos/acme/acme-gadgets/body.md", "ok")
+        for cmd in (f"gh issue create --title t --body 'fixed in {sib}: {IDENT}'", f"gh issue create --title t --body 'see gh issue list -R acme/acme-gadgets: {IDENT}'",
+                    f"gh issue create --title t --body '{IDENT}' # -R acme/other",
+                    f"gh issue create --title t --body \"say \\\"hi\\\" {s} {IDENT}\"", f"gh issue create --title t --body \"$(cat <<'EOF'\nsee {s}\n{IDENT}\nEOF\n)\"",
+                    f"gh issue create --title t --body-file - <<'EOF'\nsee {s}\n{IDENT}\nEOF",
+                    f"gh issue create --title '{IDENT}' --body {s}", f"gh issue create --title '{IDENT}' --body '{s}'",
+                    f"gh issue create --title '{IDENT}' --body-file {bodyfile}", f"gh api repos/acme/acme-widgets/issues -f title='{IDENT}' -f body={s}",
+                    f"gh api repos/acme/acme-widgets/issues -f title=t -f body='see {sib} {IDENT}'",
+                    f"curl -X POST https://api.github.com/repos/acme/acme-widgets/issues -d '{{\"body\":\"see {sib} {IDENT}\"}}'"):
+            self.assertIn("(pattern 3)", self.denied(cmd), cmd)
+
+    def test_a_sibling_write_does_not_exempt_the_next_write(self):
+        sib, own = f"gh issue create -R acme/acme-gadgets --title t --body '{IDENT}'", f"gh issue create --title t --body '{IDENT}'"
+        for cmd in (f"{sib} && {own}", f"{own} && {sib}", f"{sib}\n{own}"):
+            self.assertIn("body line 1 (pattern 3).", self.denied(cmd), cmd)
+        self.allowed(f"{sib} && {sib}")
+
+    def test_text_beside_a_write_is_not_its_target(self):
+        perun = "https://github.com/protocol/perun"
+        head = "gh pr create --title 'Fix acme-widgets crash' --body ok"
+        for cmd in (f"gh issue comment 5 --body 'Tracked upstream: {perun}/issues/12 ; acme-widgets workaround in PR 4'",
+                    f"gh issue comment 5 --body 'Tracked upstream: {perun}/issues/12 ; see acme/acme-widgets#4'",
+                    f"{head} && gh issue create -R protocol/perun --title t --body ok", f"{head} && echo 'filed {perun}/issues/3'",
+                    f"{head} && echo filed {perun}/issues/3", f"{head}; echo filed {perun}/issues/3", f"{head}\necho filed {perun}/issues/3",
+                    f"{head} # filed {perun}/issues/3",
+                    f"{head} & gh issue create -R protocol/perun --title t --body ok", f"gh pr create --title t --body \"$(cat <<'EOF'\nacme-widgets, see {perun}/pull/9\nEOF\n)\"",
+                    "gh pr create --title t --body 'run gh issue list -R protocol/perun to see acme-widgets items'"):
+            self.allowed(cmd)
+
+    def test_a_write_into_perun_naming_the_session_repository_is_still_denied(self):
+        t = "'acme-widgets crashed'"
+        for cmd in (f"gh issue create -R protocol/perun --body {t}", f"gh issue create -R protocol/perun --title t --body {t}",
+                    f"gh pr create --title t --body ok && gh issue create -R protocol/perun --title t --body {t}",
+                    f"gh pr create --title t --body ok & gh issue create -R protocol/perun --title t --body {t}",
+                    f"cd /tmp && gh issue create --title t --body {t} -R protocol/perun", f"gh issue create --title t \\\n  -R protocol/perun \\\n  --body {t}",
+                    f"bash -c \"gh issue create -R protocol/perun --title t --body {t}\"",
+                    f"curl -s https://x.example/y | jq . && gh api repos/protocol/perun/issues -f title=t -f body={t}",
+                    "curl -X POST -d '{\"body\":\"gh issue comment: acme-widgets\"}' https://api.github.com/repos/protocol/perun/issues"):
+            self.assertIn("names the session's own repository", self.denied(cmd), cmd)
+
+
+class RawFieldVersusFile(Base):
+    """gh reads `@FILE` only for -F/--field; -f/--raw-field sends the text as typed (`@jane` is a mention), and an unreadable `@FILE` is scanned as typed."""
+
+    def test_f_text_starting_with_an_at_sign_is_scanned(self):
+        for cmd in (f"gh api repos/o/r/issues -f body='@jane thanks, {IDENT} is done'", f"gh api repos/o/r/issues -f title='@jane {IDENT}'",
+                    f"gh api repos/o/r/issues --raw-field body='@jane {IDENT}'", f"gh api repos/o/r/issues -f 'body=@jane {IDENT}'"):
+            self.denied(cmd)
+
+    def test_only_a_capital_F_reads_the_file(self):
+        body = self.write("body.md", f"intro\n{IDENT}\n")
+        self.allowed(f"gh api repos/o/r/issues -f title=t -f body=@{body}")
+        for flag in ("-F", "--field"):
+            self.assertIn("body line 2 (pattern 3)", self.denied(f"gh api repos/o/r/issues -f title=t {flag} body=@{body}"))
+
+    def test_an_unreadable_F_file_is_scanned_as_typed(self):
+        self.denied(f"gh api repos/o/r/issues -F body='@jane thanks, {IDENT}'")
+        self.denied(f"gh api repos/o/r/issues --field body='@jane {IDENT}'")
+        self.allowed("gh api repos/o/r/issues -F body=@/nonexistent/body.md -f title=t")
+
+    def test_the_extraction_itself(self):
+        tail = "gh api repos/o/r/issues -f body=@jane -F title=@/nonexistent/t.md"
+        self.assertEqual(G._rest_field(tail, "", "body"), "@jane")
+        with self.assertRaises(OSError):  # the comms lint keeps treating an unreadable file as no body
+            G._rest_field(tail, "", "title")
+        self.assertEqual(G._rest_field(tail, "", "title", True), "@/nonexistent/t.md")
+        self.assertEqual(G.extract("Bash", {"command": "gh api repos/o/r/issues -f body='@jane hello'"}), ("message", "@jane hello"))
+
+
+class FeedingHeredoc(Base):
+    """A body file the command writes itself is read as the heredoc that feeds it, not as every heredoc in the command."""
+
+    def test_an_unrelated_heredoc_is_not_the_body(self):
+        f = os.path.join(self.tmp, "b.md")
+        noise, commit = f"python3 - <<'PY'\nprint('{IDENT}')\nPY\n", f"git commit -m \"$(cat <<'EOF'\n{IDENT} fix\nEOF\n)\"\n"
+        for feed in (f"cat > {f} <<'EOF'\nclean body\nEOF\n", f"cat >> {f} <<'EOF'\nclean body\nEOF\n", f"tee {f} <<'EOF'\nclean body\nEOF\n"):
+            for other in (noise, commit):
+                for cmd in (other + feed, feed + other):
+                    self.allowed(f"{cmd}gh pr create --title t --body-file {f}")
+
+    def test_the_feeding_heredoc_is_still_scanned(self):
+        f = os.path.join(self.tmp, "b.md")
+        err = self.denied(f"python3 - <<'PY'\nprint('ok')\nPY\ncat > {f} <<'EOF'\nintro\n{IDENT}\nEOF\ngh pr create --title t --body-file {f}")
+        self.assertIn("body line 2 (pattern 3)", err)
+
+
+class Wiring(unittest.TestCase):
+    def test_registered_once_on_bash_without_or_true_and_known_to_the_doctor(self):
+        with open(TEMPLATE) as fh:
+            pre = json.load(fh)["hooks"]["PreToolUse"]
+        found = [(e["matcher"], h["command"]) for e in pre for h in e["hooks"] if "privacy_guard.py" in h["command"]]
+        self.assertEqual(len(found), 1)
+        self.assertEqual(found[0][0], "Bash")
+        self.assertIn('"$CLAUDE_PROJECT_DIR/.claude/skills/agentic-delivery/scripts/privacy_guard.py"', found[0][1])
+        self.assertNotIn("|| true", found[0][1])  # exit 2 is the deny; `|| true` would turn it into an allow
+        with open(os.path.join(ROOT, "scripts/perun_doctor.py")) as fh:
+            self.assertIn('"privacy_guard.py"', fh.read())
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/scripts/test_skill_index_split.py b/scripts/test_skill_index_split.py
index 51d98ac79..c477214ef 100644
--- a/scripts/test_skill_index_split.py
+++ b/scripts/test_skill_index_split.py
@@ -92,7 +92,7 @@ def test_lookup_cost_is_measured_not_assumed(self):
         d = ROOT / ".claude/skills/agentic-delivery"
         core, lazy = (d / "INDEX.md").stat().st_size, (d / si.SCRIPTS_INDEX).stat().st_size
         self.assertLess(core, 16962)  # a reference lookup reads core only
-        self.assertLess(core + lazy, 16962 + 5300)  # a script lookup reads both: about the old size, not far above; +130 for the reply_cap and decision_gate rows, +820 for the destructive_guard_core, file_finding, repeat_poll_guard, stage_run and subagent_brief_lint rows, +150 for the feeder_order row, +200 for the train_yield row, +100 for the lkg row, +200 for the red_main row and the stage-weights/serial CLI text, +400 = +348 INDEX-scripts.md (14732->15080: host_installer, peer_ack, pregate_parity rows) +51 skills/INDEX.md (14295->14346), +100 for the vendor_drift row, +200 = +284 INDEX-scripts.md growth (admission_check, host_accept rows) plus INDEX.md regen, +100 for the lane_worktree row, +50 for the bg_admit row, +150 for wave L28 rows (council, flow_health), +1000 for wave AL rows (reply_cap, fitness_tick, flake_holder, finding_guard, baseline_guard, freeze_gate, flow_alarm, prevention_lint, quarantine; measured 21360), +300 for the freeze_hook and flow-guards rows (measured 21617), +300 for the pipeline_hub row (measured 21895), +300 for the repo_settings_audit row (measured 22162)
+        self.assertLess(core + lazy, 16962 + 5500)  # a script lookup reads both: about the old size, not far above; +130 for the reply_cap and decision_gate rows, +820 for the destructive_guard_core, file_finding, repeat_poll_guard, stage_run and subagent_brief_lint rows, +150 for the feeder_order row, +200 for the train_yield row, +100 for the lkg row, +200 for the red_main row and the stage-weights/serial CLI text, +400 = +348 INDEX-scripts.md (14732->15080: host_installer, peer_ack, pregate_parity rows) +51 skills/INDEX.md (14295->14346), +100 for the vendor_drift row, +200 = +284 INDEX-scripts.md growth (admission_check, host_accept rows) plus INDEX.md regen, +100 for the lane_worktree row, +50 for the bg_admit row, +150 for wave L28 rows (council, flow_health), +1000 for wave AL rows (reply_cap, fitness_tick, flake_holder, finding_guard, baseline_guard, freeze_gate, flow_alarm, prevention_lint, quarantine; measured 21360), +300 for the freeze_hook and flow-guards rows (measured 21617), +300 for the pipeline_hub row (measured 21895), +300 for the repo_settings_audit row (measured 22162), +200 for the privacy_guard row (measured 22303)
 
     def test_entry_index_points_at_the_lazy_file(self):
         self.assertIn(si.SCRIPTS_INDEX, (ROOT / ".claude/skills/INDEX.md").read_text(encoding="utf-8"))