Transcript scan of the 44 most-recent session JSONLs across both project dirs, counting Bash
command+subcommand pairs and splitting each candidate into LOCAL vs nested-inside-ssh (a
command that only ever runs inside `ssh host '...'` gains nothing from its own rule -- the
outer ssh is what the permission layer matches).

ADDED to permissions.allow only, 31 -> 44 entries. ask/deny/env/hooks untouched, nothing
removed or reordered, JSON re-validated and de-duplicated:
  bash scripts/creds-audit.sh * ; bash scripts/dc-dc-ceph-disk-budget.sh * ;
  bash scripts/site-baseleg.sh check* ; tofu validate* (+ -chdir variant) ;
  tofu state list* (+ -chdir variant) ; tofu state show* ; tofu providers schema* ;
  tofu version* ; ip route* ; systemctl is-active *

The substantive half of this change is what was NOT added:

- ssh (693 calls), scp (47), virsh (234) -- the three biggest prompt sources, left alone.
  They are this cloud's MUTATION TRANSPORT; CLAUDE.md hard rule 3 makes the ask rules the
  enforcement mechanism for per-mutation approval and says not to work around them, and the
  `Bash(ssh *)` disposition is an OPEN operator item queued at the 2026-07-23 close.
  Allowlisting any ssh shape would bypass the gate and pre-empt an unresolved decision.
  THIS COMMIT DOES NOT DISCHARGE THAT QUEUED PRUNE -- it is still open.
- python3 scripts/creds-matrix.py (76 local runs, the largest genuine miss) -- skipped
  because `Bash(*creds-matrix.py *--privileged*)` is an ask rule added 2026-07-26 right after
  the auto-mode classifier incident, and every prefix pattern wide enough to cover the
  observed `... 2>&1 | tail` forms would ALSO match --privileged. Allow-vs-ask precedence was
  not verified, and a rule that might silently downgrade an operator-installed gate is the
  class of change hard rule 3 forbids. Needs the precedence answer, then exact forms.
- tofu plan (54) -- read-only in effect, but CURRENT-STATE section 10 says in terms "Do NOT
  re-run `tofu plan` casually against live state". The prompt is deliberate friction.
- python3 -c/heredocs (324) and shells: arbitrary code execution. curl (114): mutation vector
  via -X/-d. tofu fmt (26): rewrites files. tofu init (10): mutates .terraform/. nft list
  (10): normally needs sudo, which correctly stays ask.

Flagged not fixed: six existing allow entries are redundant with Claude Code's built-in
auto-allow (git status/log, grep, ls, jq, cat scripts/*), and `Bash(git pull*)` sits in allow
though it is a fetch-and-merge. Removing entries was out of scope.

Folded into today's session changelog as item 6 (GA-R2/D1, ONE changelog per session) with a
per-item revert. repo-lint 0-fail; no executable surface changed, so the gauntlet result from
this session's earlier commit (ALL GREEN, 81) still stands.

Revert: drop the 13 appended lines from permissions.allow -- a contiguous deletion.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HvCyrwvYTTcDYnRErfMsNf