'it will refuse Y, and prove it' is an unscoped absolute claim; the Claude Code hook layer is explicitly best-effort and fails open

coilyco-ops commented

2026-07-01 22:10:03 +00:00

Member

Why

Persona: drive-by-critic, angle security-posture. docs/comparison-openshell.md (linked from README) makes wards flagship positioning claim in bold: "wards claim is not 'it can do X' - it is 'it will refuse Y, and prove it.'" No scope qualifier - read plainly, it applies to ward as a whole.

The thread comment this invites:

"'it will refuse Y, and prove it' - except the part that actually intercepts your agents bash calls in Claude Code. docs/hook.md, verbatim: 'The hook is a best-effort hint surface, never a hard gate' and 'Failure modes (unparseable JSON, missing fields, unknown tool, no matching route) all pass through' and 'No config reachable, parse failure, or malformed YAML all pass through silently.' So which is it - refuse and prove it, or best-effort and fail open on a bad YAML file?"

Sorted: fair. Both claims are independently true and not actually contradictory once you know cli-guards compiled verb-level gate (the real "absent at compile time" enforcement layer) is a different mechanism from the Claude Code PreToolUse hook (a separate, softer, host-side hint layer that explicitly fails open). But comparison-openshell.md states the absolute version with zero scoping, and does not link hook.md or otherwise flag that one specific layer of the product is best-effort-only. A reader who takes the positioning doc at face value and later reads hook.md reasonably feels bait-and-switched, even though a careful reader could reconcile the two.

Deliverable

Scope the claim in comparison-openshell.md: state plainly that "it will refuse Y, and prove it" describes the compiled cli-guard verb gate specifically, and that the Claude Code PreToolUse hook is a separate, best-effort convenience layer that fails open - with a link to hook.md.

Done condition

comparison-openshell.mds core claim is scoped to the mechanism that actually backs it, with an explicit, linked carve-out for the hook layers weaker guarantee.

Severity: major-friction · persona: drive-by-critic · angle: security-posture
Filed by Claude Code during a cold-read release pressure test (run 10).

## Why Persona: `drive-by-critic`, angle `security-posture`. `docs/comparison-openshell.md` (linked from README) makes wards flagship positioning claim in bold: "wards claim is not 'it can do X' - it is 'it will refuse Y, and prove it.'" No scope qualifier - read plainly, it applies to ward as a whole. The thread comment this invites: > "'it will refuse Y, and prove it' - except the part that actually intercepts your agents bash calls in Claude Code. `docs/hook.md`, verbatim: 'The hook is a best-effort hint surface, never a hard gate' and 'Failure modes (unparseable JSON, missing fields, unknown tool, no matching route) all pass through' and 'No config reachable, parse failure, or malformed YAML all pass through silently.' So which is it - refuse and prove it, or best-effort and fail open on a bad YAML file?" Sorted: **fair**. Both claims are independently true and not actually contradictory once you know cli-guards compiled verb-level gate (the real "absent at compile time" enforcement layer) is a different mechanism from the Claude Code PreToolUse hook (a separate, softer, host-side hint layer that explicitly fails open). But `comparison-openshell.md` states the absolute version with zero scoping, and does not link `hook.md` or otherwise flag that one specific layer of the product is best-effort-only. A reader who takes the positioning doc at face value and later reads `hook.md` reasonably feels bait-and-switched, even though a careful reader could reconcile the two. ## Deliverable Scope the claim in `comparison-openshell.md`: state plainly that "it will refuse Y, and prove it" describes the compiled cli-guard verb gate specifically, and that the Claude Code PreToolUse hook is a separate, best-effort convenience layer that fails open - with a link to `hook.md`. ## Done condition `comparison-openshell.md`s core claim is scoped to the mechanism that actually backs it, with an explicit, linked carve-out for the hook layers weaker guarantee. --- **Severity: major-friction** · persona: drive-by-critic · angle: security-posture Filed by Claude Code during a cold-read release pressure test (run 10).

coilyco-ops added the

pressure-test

label

2026-07-01 22:10:03 +00:00

coilyco-ops referenced this issue

2026-07-01 22:10:12 +00:00

meta: release pressure-test run log (cold-read usability sweeps) #428

coilyco-ops referenced this issue

2026-07-01 22:54:00 +00:00

README defines 'warded' as a deny-list bounding the agent's reach; container-permissions.md says no deny wall exists anywhere and isolation is the sole boundary #482

coilyco-ops added this to the ward launch milestone

2026-07-01 23:29:34 +00:00

coilyco-ops added the

headless

P1

labels

2026-07-01 23:30:27 +00:00

coilyco-ops referenced this issue

2026-07-01 23:58:52 +00:00

SECURITY.md's vulnerability scope never mentions the ward agent/container/credential surface at all #451

coilyco-ops referenced this issue

2026-07-02 00:01:42 +00:00

meta: jul 1st evening sprint - launch burndown session 1 #492

coilyco-ops commented

2026-07-02 03:01:37 +00:00

Author

Member

🔒 Reserved by ward agent --driver claude — container engineer-claude-ward-452 on host kais-macbook-pro-2.local is carrying this issue (reserved 2026-07-02T03:01:35Z). Concurrent ward agent runs are blocked until it finishes or the reservation goes stale (2h0m0s TTL); --force overrides.

— Claude (she/her), via ward agent

🔒 Reserved by `ward agent --driver claude` — container `engineer-claude-ward-452` on host `kais-macbook-pro-2.local` is carrying this issue (reserved 2026-07-02T03:01:35Z). Concurrent `ward agent` runs are blocked until it finishes or the reservation goes stale (2h0m0s TTL); `--force` overrides.  — Claude (she/her), via `ward agent`

coilysiren referenced this issue from a commit

2026-07-02 03:03:40 +00:00

docs(comparison): scope 'refuse Y, and prove it' to the compiled verb gate

coilysiren closed this issue

2026-07-02 03:03:40 +00:00

coilysiren commented

2026-07-02 03:04:07 +00:00

Owner

WARD-OUTCOME: done - scoped comparison-openshell.md's "refuse Y, and prove it" claim to the compiled cli-guard verb gate, with a linked hook.md carve-out.

Honest retrospective: this one was almost pure editorial surgery, and the critic's read was fair - the two claims never contradicted each other, but the positioning doc stated the absolute with zero scoping. The fix was to name the mechanism ("the compiled verb gate, absent at compile time, so there is nothing to fail open") and then explicitly hand the softer guarantee off to the hook layer with a link.

The only thing that fought back was the 4000-char documentation-layout cap - my first pass overshot by 180 chars and I had to tighten twice to land at 3989. Good forcing function, honestly: it kept the carve-out crisp instead of sprawling.

Confident in the result. It's a docs-only change, no runtime surface, and the claim now points at the thing that actually backs it. No follow-ups worth filing - the reconciliation the issue asked for is fully in the doc now.

WARD-OUTCOME: done - scoped comparison-openshell.md's "refuse Y, and prove it" claim to the compiled cli-guard verb gate, with a linked hook.md carve-out. Honest retrospective: this one was almost pure editorial surgery, and the critic's read was fair - the two claims never contradicted each other, but the positioning doc stated the absolute with zero scoping. The fix was to name the mechanism ("the compiled verb gate, absent at compile time, so there is nothing to fail open") and then explicitly hand the softer guarantee off to the hook layer with a link. The only thing that fought back was the 4000-char documentation-layout cap - my first pass overshot by 180 chars and I had to tighten twice to land at 3989. Good forcing function, honestly: it kept the carve-out crisp instead of sprawling. Confident in the result. It's a docs-only change, no runtime surface, and the claim now points at the thing that actually backs it. No follow-ups worth filing - the reconciliation the issue asked for is fully in the doc now.

coilyco-ops commented

2026-07-02 08:03:50 +00:00

Author

Member

🔒 Reserved by ward agent --driver claude — container engineer-claude-ward-452 on host kais-macbook-pro-2.local is carrying this issue (reserved 2026-07-02T08:03:47Z). Concurrent ward agent runs are blocked until it finishes or the reservation goes stale (2h0m0s TTL); --force overrides.

— Claude (she/her), via ward agent

🔒 Reserved by `ward agent --driver claude` — container `engineer-claude-ward-452` on host `kais-macbook-pro-2.local` is carrying this issue (reserved 2026-07-02T08:03:47Z). Concurrent `ward agent` runs are blocked until it finishes or the reservation goes stale (2h0m0s TTL); `--force` overrides.  — Claude (she/her), via `ward agent`

coilyco-ops commented

2026-07-02 08:03:54 +00:00

Author

Member

🔒 Reserved by ward agent --driver claude — container engineer-claude-ward-452 on host kais-macbook-pro-2.local is carrying this issue (reserved 2026-07-02T08:03:47Z). Concurrent ward agent runs are blocked until it finishes or the reservation goes stale (2h0m0s TTL); --force overrides.

— Claude (she/her), via ward agent

🔒 Reserved by `ward agent --driver claude` — container `engineer-claude-ward-452` on host `kais-macbook-pro-2.local` is carrying this issue (reserved 2026-07-02T08:03:47Z). Concurrent `ward agent` runs are blocked until it finishes or the reservation goes stale (2h0m0s TTL); `--force` overrides.  — Claude (she/her), via `ward agent`

coilyco-ops commented

2026-07-02 08:03:57 +00:00

Author

Member

🔒 Reserved by ward agent --driver claude — container engineer-claude-ward-452 on host kais-macbook-pro-2.local is carrying this issue (reserved 2026-07-02T08:03:47Z). Concurrent ward agent runs are blocked until it finishes or the reservation goes stale (2h0m0s TTL); --force overrides.

— Claude (she/her), via ward agent

🔒 Reserved by `ward agent --driver claude` — container `engineer-claude-ward-452` on host `kais-macbook-pro-2.local` is carrying this issue (reserved 2026-07-02T08:03:47Z). Concurrent `ward agent` runs are blocked until it finishes or the reservation goes stale (2h0m0s TTL); `--force` overrides.  — Claude (she/her), via `ward agent`

coilysiren commented

2026-07-02 08:05:17 +00:00

Owner

WARD-OUTCOME: done - deliverable already landed on main (commits fc76948 + f911f44); this re-dispatch verified it, nothing new to commit.

Honest retrospective: I came in ready to do the editorial surgery and found it already done. A prior run at 03:04Z had already scoped the "refuse Y, and prove it" claim to the compiled cli-guard verb gate and added the explicit, linked hook.md carve-out (plus the enforcement-boundary.md pointer), and it was landed on origin/main and the issue closed. So my part was verification rather than authoring: confirmed comparison-openshell.md lines 51-66 name the mechanism and hand the softer, fail-open guarantee off to the hook layer with live links, confirmed both linked docs exist, and confirmed the tree is clean with HEAD == origin/main.

The one thing worth flagging is not the fix but the dispatch: this issue was already closed when I picked it up, and the reservation churn (three reservation comments in ~10s at 08:03Z) suggests a re-dispatch of completed work rather than a fresh task. Confident the done-condition is fully met. No follow-ups on the doc itself; the only rough edge is process-side (closed issues getting re-queued), not code.

WARD-OUTCOME: done - deliverable already landed on main (commits fc76948 + f911f44); this re-dispatch verified it, nothing new to commit. Honest retrospective: I came in ready to do the editorial surgery and found it already done. A prior run at 03:04Z had already scoped the "refuse Y, and prove it" claim to the compiled cli-guard verb gate and added the explicit, linked hook.md carve-out (plus the enforcement-boundary.md pointer), and it was landed on origin/main and the issue closed. So my part was verification rather than authoring: confirmed comparison-openshell.md lines 51-66 name the mechanism and hand the softer, fail-open guarantee off to the hook layer with live links, confirmed both linked docs exist, and confirmed the tree is clean with HEAD == origin/main. The one thing worth flagging is not the fix but the dispatch: this issue was already closed when I picked it up, and the reservation churn (three reservation comments in ~10s at 08:03Z) suggests a re-dispatch of completed work rather than a fresh task. Confident the done-condition is fully met. No follow-ups on the doc itself; the only rough edge is process-side (closed issues getting re-queued), not code.

coilysiren referenced this issue

2026-07-03 17:30:50 +00:00

Add publish-kdl-read producer job so read-only director sessions get the ward-kdl-read observe surface #572

Rows
Columns

'it will refuse Y, and prove it' is an unscoped absolute claim; the Claude Code hook layer is explicitly best-effort and fails open #452

Why

Deliverable

Done condition