caveman: disable on live host + SEC-017 + fail-closed compress guardrails ...

Council-reviewed follow-through on the caveman plugin (operator accepted the
recommendations). Three gated deliverables:

1. DISABLED on the live host: enabledPlugins."caveman@caveman"=false at user
   (~/.claude, uncommitted) + committed repo scope; env CAVEMAN_DEFAULT_MODE=off
   retained; marketplace kept for deliberate re-enable. Stops the per-turn
   third-party hook execution (which ran regardless of mode=off) at next
   session start.
2. SEC-017 opened (docs/security-ledger.md): supply-chain re-verify obligation
   pinning SHA 0d95a81 + self-remeasured baseline hashes; register = OPS (no
   D-number per GA-R3; precedent D-129). Open SEC 12->13, reconciled at Stage 4
   close (not an L10 trigger; CURRENT-STATE untouched).
3. Guardrails: repo-lint L11 FAILs on any *.original.md (caveman-compress
   residue), opt-out marker + harness T42-T44 (45/45 PASS); .claude/settings.json
   deny on Bash(*python3 -m scripts*)+Bash(*caveman-compress*); CLAUDE.md
   "Tooling guardrails" prohibiting the compressor against any repo-tracked
   prose. Rejected the proposed plugin-hash-baseline-in-repo-lint (layering
   violation; drift belongs in the SEC-017 re-verify duty).

Harness-config + governance only; no cloud mutation. repo-lint 0 fail;
gauntlet ALL GREEN (77). Changelog: docs/changelog-20260724-caveman-disable.md.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUjEb7onHpdqFHUnio6iVw

caveman plugin: off-by-default opt-in guard (repo + user CAVEMAN_DEFAULT_MODE=off) ...

Installed the third-party caveman Claude Code plugin (user scope) per operator
direction, then guarded it off-by-default so it never auto-arms while operating
the cloud. Hooks inspected read-only first: purely behavioral, no network /
credential access. Repo .claude/settings.json carries env CAVEMAN_DEFAULT_MODE=off
(durable, shared); the same guard was added to ~/.claude/settings.json (out of
repo, not committed) for off-by-default across all repos. /caveman still
activates on demand for future hardened-workflow deployment testing.

Harness-config only: no cloud mutation, no status change (CURRENT-STATE
untouched), repo-lint 0 fail. Changelog: docs/changelog-20260723-caveman-optin-guard.md.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUjEb7onHpdqFHUnio6iVw

Session permissions: allow ledger-scan + opentofu-validate (read-only; gates untouched) ...

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUjEb7onHpdqFHUnio6iVw

Permissions: targeted ask rules for scp / pipe-to-ssh / ssh-virsh (classifier walls -> gates, per 2026-07-19 ruling) ...

Deploy-window surfaces that hard-denied and stalled work: scp staging to
the dc0 rack, cat|ssh file staging, nested virsh over ssh. Per the ruled
convention these become ASK (approval prompts, Remote-Control friendly),
never allow -- hard rule 3 mutation gating is unchanged, and read-only
ssh probes stay frictionless.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KiUu1oqt76tWvV4vEC3NAr

Permission posture: extend ask rules (Remote Control approve flow, no walls) ...

Operator-directed: git mutations (merge/revert/reset/rebase/branch -D),
script mutation verbs (bash scripts/* apply|install), ssh-sudo, and
Skill(*) added to ask so they PROMPT instead of classifier hard-deny.
Nothing auto-allowed; deny + guard hook unchanged. Skill(*) syntax
verified empirically (pre-change call hard-denied, post-change call
prompted + ran). Extends the 2026-07-18 ask-preempts-classifier posture.

Revert: git revert this commit.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VZbUeRE8weySLSGY1odrCi

Permission posture: ask-list mutation surfaces so they PROMPT (not classifier-deny) ...

Root cause (claude-code-guide, doc-cited): in auto mode, unmatched mutations
fall to the classifier and get HARD-DENIED (no approval prompt). ask/deny rules
are evaluated BEFORE the classifier, so ask-listing the mutation surfaces forces
an approve/deny/adjust prompt -- the intended gating.

.claude/settings.json (operator-applied; editing the permission file is itself
gated): + ask for *opnsense-api.sh POST, *opnsense-plugins.sh apply, *tofu
apply/destroy/import/state rm, *--commit, Edit(.claude/settings*.json); + allow
for the edge GET + opnsense-plugins.sh list. deny + guard hook unchanged.

Changelog + ledger note + carry-forward (verify prompts post-reload) added.

Revert: git revert this commit, or cp .claude/settings.json.bak over it.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JUBUyinU4sBAT4HV1b9vSz

Claude code patch