Doctor said NONE. Measured.
/ork:doctor told operators that reading ~/.ssh/id_rsa
had zero hook coverage. A hook had been denying it since 2026-08-16.
What the check actually shipped
| ❌ permissions.deny 0 credential-read rules across 4 scopes |
| Read(~/.ssh/**) has ZERO hook coverage. Measured, not assumed. |"Measured, not assumed" is the part that stings: the claim was measured once, became false when the guard landed, and kept asserting its own rigour. The same dangling-pointer class #3553 fixed one section over.
Second gap: nothing tested it
The guard shipped with zero behavioural tests. Its two hardest-won
behaviours — the macOS case-fold bypass (~/.SSH/id_rsa opens the
same bytes on APFS) and dual lexical/realpath matching — were asserted by
nothing. Dropping the fold would have shipped green. There are now 20 tests,
mutation-checked three ways: removing the fold fails 2, narrowing the rules
fails 3, and denying everything fails 6.
cat ~/.ssh/id_rsa
through Bash is a different lane. Deny rules are still worth having as defence
in depth — which is what the corrected row now says.