Purge wave 4: the big two, and the purge is done
Divergence purge #3835, PR 6 of 6 · dangerous-command-blocker and git-validator · 2026-08-31
The day in one strip: 29 blocking hooks audited, 16 deleted, 13 kept
wave 1 dead four, compound-command-validator, agent-browser-safety
wave 2 egress ASK tier, cron-guard, team-size-gate, restrict-bash, pre-commit-quality-runner
wave 3 file-guard, credential-read-guard (after the security baseline moved)
wave 4 dangerous-command-blocker, git-validator
KEEP content-secret-scanner, egress DENY tier, context-file-budget-guard, MCP config validators,
elicitation-guard, Stop tier, fable-spend-consent, model-cost-advisor, goal trio, notifications, session spine
What the two deletions cost, stated
| hook | native replacement | given up (operator decision) |
|---|---|---|
dangerous-command-blocker (147 cases, 5 security files) | every DENY pattern is a Bash() deny rule in the operator payload; CC enforces it before any hook, under --dangerously-skip-permissions too | the ASK tier (git reset --hard, clean -fd, stash drop, force-push to feature branches, checkout ., terraform destroy, sudo); the three SQL substrings; quote and heredoc scan views |
git-validator (147 cases) | force-push deny rules + origin branch protection | protected-branch commit deny by current-branch state, branch-naming and commit-format lints (a rule cannot read the branch) |
Where the blocker was a fixture, not the subject
run-hook-rewake, run-hook-verdict-telemetry, run-hook-stdin-timeout, input-validation, test-permission-mode-matrix used "rm -rf /" through the blocker to prove RUNNER mechanics (exit codes, telemetry rows, every permission mode) now use "eval $(curl ...)" through network-egress-guard's DENY tier, the surviving Bash deny the property under test is unchanged; only the fixture moved the retiring blocker also blocked its own deletion scripts twice (the literal in a .replace call); the deletion had to build the string at runtime. Noted, because it is the whole point.
Gates at commit
| hooks suite | 7138 passed, 2 skipped; entries-map pin 197 to 195 on this branch (the last purge PR to land re-pins to the sum) |
| security suite | 20/20; four files as STATIC tripwires, three re-pointed to the egress guard |
| mutation gate | held at the pre-existing baseline (jq, sqlite); additional-security keeps a live expect_decision on the egress deny so it can still bite |
| verdict probes | 15/15 (remote-exec deny replaces the catastrophic-rm probe; force-push-ask and pipe-to-shell retired) |
| counts | 176 to 174: two skill hooks: blocks removed (commit, security-patterns) |
After this merges: setup once (/ork:setup, phase 3.6, consent) gives real OS/CC-enforced protection; /ork:doctor says whether it is on; the prompts both users fled from are gone; the CI canary probe reads REGRESSED the day CC's rule layer changes.