Purge wave 2: the ask storm ends

Divergence purge #3835, PR 4 of 6 · the wave that answers this morning's two user reports · 2026-08-31

What the users heard, and which hook said it

Yotam  "it stops me every time... something about the sandbox... I run with dangerously-skip-permissions"
Nir    "Yes or No every few minutes since early August"

network-egress-guard ASK tier:  "Uploads data to a non-allowlisted host (X). Possible exfiltration. Proceed?"
                                on every scp / rsync / curl -d / nc to a host outside 14 built-ins.
                                Their own servers were never on the list. Unattended runs hung.

Deleted in this wave

hook	native replacement	cost accepted
`network-egress-guard` ASK tier	`sandbox.network.allowedDomains/deniedDomains` in the operator scope; setup writes it with consent, doctor audits it	none: the DENY tier (executing fetched bytes) stays and is now posture-independent by test
`cron-guard` (the one hooks.json entry: 176 to 175)	`deny: ["CronCreate"]` in a CI settings scope	none
`team-size-gate`, `restrict-bash`	agent `tools:`/`disallowedTools` frontmatter + the --restricted CI lane	deny-by-default allowlisting and the spawn counter go
`pre-commit-quality-runner`	`bin/git-hooks/` and CI run the same tsc/eslint checks	no PreToolUse-time lint on `git commit`

Try it: a command, before and after

Gates at commit

hooks suite	7591 passed, 2 skipped; entries-map pin 197 to 194 (188 once wave 1 is also on main)
registry closure	PASS, zero grandfathered
verdict probes	17/17 (cron-guard probe retired)
security suite	20/20; the four former asks pinned as abstain so a revived tier fails there
counts	re-stamped 176 to 175 across the six sibling files

What still asks after this wave: CC's own permission prompts (which honour the rules setup writes), and ork's KEEP set: secret bytes about to be written, the context-file budget, spend consent. None of those fires on scp to your own server.