fix(hooks): keep authorized publication reachable

Cause: the portable command hook hard-denied every protected-branch publication even though Codex could not project the owner's trusted approval into the hook process. The same raw-string classifier treated inert search queries as executable effects.

Scope: additive and atomic protected-branch publication is now advisory on the host's native authority path. History rewrites and branch deletion remain exact-digest guarded. Quoted rg/grep query payloads are ignored only when the whole command is a non-expanding search, and a chained destructive effect still fails closed. Canonical product, architecture, isolation, compatibility, hook, README, and changelog contracts now describe that boundary.

Verification: pytest hooks/tests/test_v026_hooks.py -q -k protected_branch_publication_is_advisory_when_host_authority_is_not_projected (red: 1 failed; green: 1 passed); pytest hooks/tests/test_v026_hooks.py -q -k read_only_search_payload_is_not_classified_as_a_shell_effect (red: 1 failed; green: 1 passed); pytest hooks/tests/test_v026_hooks.py -q -k protected_branch_history_rewrite_remains_exact_digest_guarded (red: 1 failed; green: 1 passed); npm run verify:release (Node 111 passed, Hooks 13 passed, audit 0 vulnerabilities); npm pack --dry-run --json (0.26.1, 113 entries).

Residual risk: portable hooks still cannot consume a uniform native approval receipt across all five hosts. Other destructive classes therefore retain the explicit environment-scoped digest path, and inert-query suppression is intentionally limited to rg/grep-family commands.

Rollback: revert this commit to restore exact-digest denial for every protected-branch publication.

Author: rocky2431

.ultra/specs/architecture.md

@@ -76,11 +76,13 @@ Adapters generate host metadata and wire payloads without editing shared workflo
 | `mid_workflow_recall.py` | active acceptance and source operation | bounded reminder | silent outside Ultra; diagnostic failure |
 | `compact_context.py` | files and Git | disposable snapshot | rebuild from authority |
 | `post_edit_guard.py` | edited path, ledger, task trace | normalized mechanical progress observation | malformed prior observation is repaired; semantic gaps stay advisory |
-| `block_dangerous_commands.py` | exact shell command and optional exact authorization digest | deny protected push, destructive data operation, funds, secret, or eval | denial names protected effect and reachable authorization path |
+| `block_dangerous_commands.py` | exact shell command and optional exact authorization digest | advise additive protected push; deny protected history rewrite/deletion, destructive data operation, funds, secret, or eval | advisory preserves the host authority path; denial names protected effect and reachable authorization path |
 
-A database migration is advisory because migration meaning and reversibility are not
-decidable from a command pattern. Only the named externally verifiable effects fail
-closed.
+An additive protected push is advisory because Git publication is recoverable and
+portable Hook wiring cannot consume every host's trusted approval receipt. History
+rewrites and branch deletion remain guarded. A database migration is also advisory
+because migration meaning and reversibility are not decidable from a command pattern.
+Only the remaining named externally verifiable destructive effects fail closed.
 
 ## Delegation Boundary
 

.ultra/specs/product.md

@@ -78,7 +78,9 @@ artifact audit, and resume contracts.
 
 Hooks are idle when `.ultra/` is absent. Context Hooks inject bounded canonical facts;
 observation Hooks write only derived data; only named destructive effects can be denied,
-with an exact authorization repair. Verification: Python Hook suite.
+with an exact authorization repair. Recoverable additive protected-branch publication
+stays advisory when trusted host authority is not projected into the portable Hook;
+history rewrites and branch deletion remain guarded. Verification: Python Hook suite.
 
 ### Requirement FR-06: Bounded delegation
 

CHANGELOG.md

@@ -37,6 +37,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   rest of an isolated checkout.
 - Made dangerous-command authorization reachable by hashing the protected effect
   independently of its retry spelling.
+- Kept additive protected-branch publication on the host's native authority path instead
+  of hard-blocking an already owner-authorized release, retained exact-digest guards for
+  history rewrites and branch deletion, and stopped treating inert searches as effects.
 - Kept expandable interpreter heredocs inside dangerous-effect inspection while
   continuing to treat quoted commit-message heredocs as data.
 - Required explicit owner authority before `ultra-review` can launch a cross-host

README.md

@@ -219,7 +219,7 @@ Five optional hooks accelerate file reading and protect a narrow effect boundary
 | `mid_workflow_recall.py` | Restate acceptance before relevant source operations |
 | `compact_context.py` | Save and restore a disposable Git/file snapshot |
 | `post_edit_guard.py` | Record mechanical evidence observations after edits |
-| `block_dangerous_commands.py` | Deny named destructive shell effects until the exact command is authorized |
+| `block_dangerous_commands.py` | Advise on additive protected-branch publication; deny history rewrites and named destructive shell effects until the exact command is authorized |
 
 All five exit silently when `.ultra/` is absent. Details are in
 [Plugin Isolation](docs/PLUGIN-ISOLATION-CONTRACT.md).

docs/ARCHITECTURE.md

@@ -87,7 +87,10 @@ the parent model runs the same references sequentially.
 Five hooks read canonical files and emit bounded context or observations. Their output
 under `.ultra/.runtime/`, `.ultra/progress/`, or `.ultra/reviews/` is derived and
 disposable. The dangerous-command hook is the only hard effect guard; it classifies a
-small named set of shell effects and provides an exact-command authorization repair.
+small named destructive set and provides an exact-command authorization repair.
+Additive protected-branch publication remains advisory when portable host wiring cannot
+project a trusted owner-approval receipt; history rewrites and branch deletion remain
+guarded.
 
 ## Completion and recovery
 

docs/DECISIONS.md

@@ -52,8 +52,10 @@ No single sensor is promoted into a semantic completion gate.
 
 The hook surface is session context, mid-workflow acceptance recall, compact snapshot,
 post-edit evidence observation, and dangerous-command protection. Every hook is silent
-without `.ultra/`. Only a narrow named destructive effect can be denied, and its repair
-is authorization scoped to the exact command digest.
+without `.ultra/`. Additive protected-branch publication is advisory because the
+portable hook cannot receive every host's trusted owner-approval receipt. History
+rewrites, branch deletion, and the narrower named destructive effects can be denied;
+their repair is authorization scoped to the exact command digest.
 
 ## Delegation is a process boundary
 

docs/PHILOSOPHY.md

@@ -61,16 +61,20 @@ agents to find loopholes (rename `mock` to `stub`, etc.). The cheaper path must
 
 ### C3 — Sensors not Blockers
 
-Hooks emit signal; agents and users decide. Block only the **truly irreversible**:
+Hooks emit signal; agents and users decide. Block only the **truly irreversible or
+privileged destructive** effects for which the hook has an exact repair:
 
-- `git push` to protected branches
 - Funds transfer / on-chain transactions
-- DB migrations / `DROP` / `TRUNCATE`
+- Protected-branch history rewrite or deletion
+- `DROP` / `TRUNCATE`
 - Hardcoded secret commit
 - Arbitrary code execution driven by user input
 
-Everything else is advisory on stderr — the work stands, the signal is delivered, the agent
-proceeds.
+Additive protected-branch publication and database migrations are advisory: the former
+remains recoverable through Git and the portable hook cannot receive every host's
+trusted approval receipt; the latter is not mechanically classifiable as reversible or
+irreversible. The work stands, the signal is delivered, and the agent proceeds inside
+the owner's authorized frame.
 
 > **Why this is absolute**: hard final gates and hard pre-commit gates each produced the same
 > over-correction loop in v7 — the agent weakened tests to escape the gate and drifted from the

docs/PLUGIN-ISOLATION-CONTRACT.md

@@ -70,9 +70,12 @@ Every hook resolves the current project and checks for `.ultra/` before reading,
 writing, injecting context, or denying an effect. Without `.ultra/`, it emits no stdout,
 exits zero, and leaves the project untouched.
 
-The only hook denial is a named dangerous shell effect in an active Ultra project. The
-denial identifies the protected effect and supplies an exact-command SHA-256
-authorization path. All other hook failures are fail-open diagnostics.
+The only hook denial is a named destructive shell effect in an active Ultra project.
+The denial identifies the protected effect and supplies an exact-command SHA-256
+authorization path. Additive protected-branch publication is an advisory observation
+because a portable hook cannot consume every host's trusted owner-approval receipt;
+history rewrites and branch deletion remain guarded. All other hook failures are
+fail-open diagnostics.
 
 ## Project data boundary
 

docs/RUNTIME-COMPAT-MATRIX.md

@@ -60,7 +60,7 @@ host feature OpenCode does not expose.
 | mid-workflow recall | yes | handles `apply_patch` | native bridge | normalized | executed |
 | compact context | pre/start | pre/post | native compact event | pre/post | pre-compact |
 | post-edit observation | Write/Edit | Write/Edit/`apply_patch` | write/edit/patch | Write/Edit | Write/Edit/patch |
-| dangerous command guard | Bash | Bash | bash | Bash | Bash deny mapping |
+| dangerous command guard | Bash advisory/deny | Bash advisory/deny | bash advisory/deny | Bash advisory/deny | Bash allow/deny mapping |
 
 All hooks share the same `.ultra/` idle guard. Wire adapters normalize payload and
 output fields only; they do not change semantic policy. Codex installation health and

hooks/README.md

@@ -9,7 +9,7 @@ directory and exits silently when the workflow is not active.
 | `mid_workflow_recall.py` | Before source reads or edits | Restate current acceptance only |
 | `compact_context.py` | Before/after compaction | Save and restore a disposable snapshot derived from files and Git |
 | `post_edit_guard.py` | After edits | Record mechanical evidence observations without deciding completion |
-| `block_dangerous_commands.py` | Before shell execution | Block a narrow named external effect until the exact command is owner-authorized |
+| `block_dangerous_commands.py` | Before shell execution | Advise on additive protected-branch publication; block history rewrites and a narrow destructive set until the exact command is owner-authorized |
 
 `_common.py` is a shared library, not a lifecycle registration. Compact snapshots and
 progress observations live under ignored `.ultra/.runtime/` or `.ultra/progress/`; the
@@ -18,5 +18,7 @@ canonical semantic facts remain the owner-readable files and Git.
 Claude Code runs the hooks directly. Codex, Kimi Code, and Grok Build use the small
 wire adapters under `hooks/adapters/`. OpenCode calls the same scripts from its native
 JavaScript plugin. A hook failure is advisory except for the explicitly classified
-external effects in `block_dangerous_commands.py`, whose denial includes a reachable
-SHA-256-scoped authorization path.
+destructive effects in `block_dangerous_commands.py`, whose denial includes a reachable
+SHA-256-scoped authorization path. Additive protected-branch publication stays advisory
+because portable hooks cannot consume every host's trusted owner-approval receipt;
+history rewrites and branch deletion remain guarded.